Glossary

A machine that is physically disconnected from every network, used to handle material that must never touch the internet — for example, opening an untrusted document or holding an encryption key. The isolation is only as good as the discipline around what moves on and off it via removable media.

See also: Compartmentalization, OPSEC

An operating system that runs entirely from RAM and writes nothing to the host's disk, so the session leaves no trace on the machine when it powers off. Tails is the best-known example; the property protects the computer you borrowed, not the network path you used.

See also: Tails, Persistent Storage

The group of people you are indistinguishable from. Anonymity is a function of crowd size rather than of any single setting, which is why unusual configurations reduce privacy even when each individual change looks protective.

See also: Browser Fingerprinting, Letterboxing, Pseudonymity

The cellular modem and its proprietary firmware, which runs independently of the phone's main operating system. Hardened Android distributions isolate the baseband from the rest of the system but cannot audit or replace it.

See also: IMSI Catcher, GrapheneOS

An unlisted Tor relay that does not appear in the public directory, used where an ISP or state blocks connections to known Tor entry points. Bridges are distributed in limited quantities precisely so that censors cannot enumerate and block them all.

See also: Pluggable Transport, Tor, Entry Guard

Identifying a visitor from the combination of properties their browser and device expose — screen size, fonts, timezone, graphics behaviour, and dozens more — without storing anything on the device. Because nothing is stored, clearing cookies and changing IP address do not remove it.

See also: Canvas Fingerprinting, Entropy, Farbling, Letterboxing

A fingerprinting technique that asks the browser to render text or graphics and hashes the exact pixels returned. Small differences in GPU, driver, and font rasterisation make the result stable per device and highly distinguishing.

See also: Browser Fingerprinting, Farbling

Keeping separate identities, accounts, devices, and payment methods strictly apart so that a compromise or a link in one does not reach the others. Most deanonymisation happens at the seam where two compartments touch, not by breaking encryption.

See also: OPSEC, Pseudonymity, Stylometry

Linking the traffic entering an anonymity network with the traffic leaving it, using volume and timing patterns rather than decrypting anything. An adversary who can observe both ends of a Tor circuit can often confirm a connection without breaking any cryptography.

See also: Traffic Analysis, Tor, Exit Node

A company whose business is assembling and reselling personal records — addresses, phone numbers, relatives, purchase history — collected from public records, apps, loyalty programmes, and other brokers. Removal usually requires an individual opt-out request per broker, and records often reappear.

See also: Right to Erasure, Doxxing

Linking pseudonymous or anonymous activity back to a real identity. It is normally achieved by combining several weak signals — a reused username, a timestamp pattern, a payment method, a document's metadata — rather than by defeating encryption.

See also: Compartmentalization, Metadata, Stylometry

Network equipment examining the contents and characteristics of traffic rather than only its destination, typically to classify or block particular protocols. It is the mechanism behind national-level blocking of VPN and Tor handshakes.

See also: Pluggable Transport, Bridge

A situation where name lookups bypass an encrypted tunnel and go to the default resolver, revealing every domain visited to the ISP or resolver operator even though the traffic itself is tunnelled. It is a common misconfiguration in VPN clients and manual proxy setups.

See also: DNS over HTTPS, VPN, Kill Switch

A protocol that carries DNS queries inside an ordinary HTTPS connection so that a local network observer cannot read or trivially tamper with them. It hides lookups from the network but transfers that visibility to whoever operates the resolver.

See also: DNS Leak, Encrypted SNI

Publishing someone's identifying details — home address, workplace, phone number, family members — usually to enable harassment. It is typically assembled from data brokers, old accounts, and material the target published themselves years earlier.

See also: Data Broker, Right to Erasure

An extension that conceals the hostname sent in the clear during a TLS handshake, closing one of the last plaintext indicators of which site is being visited. Without it, an observer learns the destination even when the page contents are encrypted.

See also: DNS over HTTPS, Deep Packet Inspection

Encryption applied on the sender's device and removed only on the recipient's, so that every intermediary — including the service operator — relays ciphertext it cannot read. It protects message content and says nothing about who talked to whom.

See also: Metadata, Forward Secrecy, Zero-Access Encryption

In fingerprinting, a measure of how much a given attribute narrows down who you are. A value shared by half of all users carries one bit; several moderately rare values multiplied together are frequently enough to leave a pool of one.

See also: Browser Fingerprinting, Anonymity Set

The first relay in a Tor circuit, deliberately kept stable for months at a time. Rotating the first hop constantly would eventually route a user through a hostile relay, so Tor trades a small risk of a persistent bad guard for a much lower cumulative one.

See also: Tor, Correlation Attack, Exit Node

Metadata embedded in photographs by cameras and phones, which can include GPS coordinates, the exact capture time, and the device serial number. Many platforms strip it on upload and many do not, so removing it before sharing is the only reliable approach.

See also: Metadata, Deanonymization

The final Tor relay, which makes the connection to the destination site and therefore sees the traffic in whatever form it was sent. Anything not protected by HTTPS is readable there, which is why exit-node operators are an assumed adversary rather than a trusted party.

See also: Tor, Entry Guard, Onion Service

Brave's approach to fingerprinting defence: perturbing the output of semi-identifying browser APIs using a seed that is unique per site and per session, so one site sees consistent values while no two sites can match their observations to each other.

See also: Browser Fingerprinting, Letterboxing, Canvas Fingerprinting

A property of a protocol in which compromising a long-term key does not expose messages that were already sent, because each session uses ephemeral keys that are discarded afterwards. It defeats the harvest-now-decrypt-later strategy for past traffic.

See also: End-to-End Encryption, Post-Quantum Cryptography

Encryption of an entire storage volume so that its contents are unreadable while the device is powered off or locked. It defends against a lost or seized device and does nothing at all once the device is unlocked and running.

See also: Verified Boot, Amnesic System

A hardened Android distribution focused on exploit mitigation, offering a hardened memory allocator, network and sensors permissions, storage scopes, and Google Play confined to the ordinary app sandbox. Its narrow device list follows from hardware requirements such as verified boot with rollback protection and memory tagging.

See also: Verified Boot, Sandboxed Google Play, microG, Storage Scopes

A physical authenticator that performs a challenge-response with the site it was registered to, so a credential captured on a lookalike domain is useless. It is the only widely available second factor that resists phishing by design.

See also: Two-Factor Authentication, Password Manager

A device that impersonates a cell tower so nearby phones connect to it, revealing subscriber identifiers and approximate location, and in some configurations downgrading the connection to a weaker protocol. It operates below the phone's operating system, so no app or ROM prevents it.

See also: Baseband, Metadata

A VPN client feature that blocks all traffic if the tunnel drops, rather than letting it fall back to the ordinary connection. Without it, a brief reconnection exposes the real IP address at exactly the moment the user believes they are covered.

See also: VPN, DNS Leak

Identity-verification requirements imposed on financial services, requiring documents that bind an account to a legal name. KYC at the point where money enters a system is what makes most nominally pseudonymous payment traceable.

See also: Monero, Deanonymization

Tor Browser's defence against window-size fingerprinting: the page is rendered into a bucketed size with margins added, so many users report the same dimensions instead of a value unique to their monitor and window.

See also: Browser Fingerprinting, Anonymity Set, Tor

Presenting a different hardware address to each Wi-Fi network, or to each connection, so that venues and networks cannot track a device by its permanent identifier. Per-connection randomisation is stronger than a stable random address kept per network.

See also: Metadata, GrapheneOS

Data about a communication rather than its contents: who contacted whom, when, how often, from where, and for how long. It is generally easier to collect and analyse at scale than content, and it is frequently more revealing.

See also: End-to-End Encryption, Traffic Analysis, Sealed Sender

A free-software reimplementation of Google Play services used by CalyxOS and others, providing core functions such as push notifications without the proprietary components. Compatibility is broader than having no Play services and narrower than running the official ones.

See also: Sandboxed Google Play, GrapheneOS

An anonymity design in which messages are batched, reordered, and delayed by intermediate nodes so that input and output cannot be matched by timing. It resists correlation better than low-latency onion routing at the cost of being unusable for interactive traffic.

See also: Onion Routing, Correlation Attack, Traffic Analysis

A cryptocurrency designed so that sender, recipient, and amount are obscured by default, using ring signatures, stealth addresses, and confidential transactions. Its privacy properties depend heavily on how the coins were acquired and how they are spent.

See also: Know Your Customer, Compartmentalization

A provider's claim not to retain records that could link a user to their activity. The claim is only as strong as the evidence behind it: an independent audit, a published infrastructure design, or a court order the provider demonstrably could not satisfy.

See also: VPN, Warrant Canary

Wrapping traffic in successive layers of encryption and sending it through several relays, each of which can remove only its own layer. No single relay knows both the origin and the destination, which is the property Tor is built on.

See also: Tor, Exit Node, Mix Network

A service reachable only inside the Tor network via a .onion address, where the connection never leaves Tor and neither party learns the other's IP address. It removes the exit node from the path entirely.

See also: Tor, Exit Node, Onion Routing

Operational security: the habits and procedures that stop an adversary assembling small, individually harmless facts into an identification. In practice it is the layer that fails, long before the cryptography does.

See also: Compartmentalization, Stylometry, Deanonymization

An encrypted vault that generates and stores a unique credential per site, so that a breach of one service cannot be replayed against the others. It also blunts phishing, because the manager will not autofill on a domain it does not recognise.

See also: Two-Factor Authentication, Hardware Security Key

An optional encrypted volume on an otherwise amnesic system, holding only the specific files and settings the user chooses to keep. Every item stored there is a deliberate trade of forensic cleanliness for convenience.

See also: Amnesic System, Full-Disk Encryption

A layer that disguises the shape of Tor traffic so that censorship equipment cannot recognise it — as random noise, as a video call, or as a connection to a large cloud provider. It addresses blocking, not anonymity.

See also: Bridge, Deep Packet Inspection, Tor

Algorithms designed to remain secure against an adversary with a large quantum computer, deployed today alongside classical algorithms so that traffic recorded now cannot be decrypted later. Messaging protocols have begun shipping hybrid constructions for exactly this reason.

See also: Forward Secrecy, End-to-End Encryption

Acting under a persistent name that is not your legal identity. It is not anonymity: the persistence is what makes it useful and also what makes it accumulate linkable history over time.

See also: Anonymity Set, Compartmentalization, Stylometry

A legal mechanism in several jurisdictions requiring a controller to delete personal data on request, subject to exceptions. In practice it is a per-controller process with its own evidence requirements, not a single switch that clears the record.

See also: Data Broker, Doxxing

Running the official Google Play components as an ordinary, unprivileged application confined to the standard app sandbox, rather than as a privileged system service. It preserves compatibility with apps that require Play while removing its elevated access.

See also: GrapheneOS, microG, Storage Scopes

A Signal mechanism that encrypts the sender's identity in the message envelope, so the server relaying a message cannot see who sent it. It reduces the metadata a compelled operator can produce.

See also: Metadata, End-to-End Encryption

A permission model in which an app is granted access to a specific, user-defined subset of files or contacts while believing it received the broad permission it requested. It converts an all-or-nothing prompt into a negotiable one.

See also: GrapheneOS, Sandboxed Google Play

Identifying an author from measurable features of their writing — vocabulary, punctuation habits, sentence rhythm, characteristic errors. It is a practical deanonymisation route against a pseudonym that publishes a large volume of text.

See also: Pseudonymity, Deanonymization, OPSEC

Any storage or caching mechanism repurposed to hold a persistent identifier outside the normal cookie store, so that clearing cookies does not remove it. Browsers have closed many of these, and fingerprinting has largely displaced the technique.

See also: Browser Fingerprinting, Entropy

A live operating system booted from removable media that runs from RAM, forces all connections through Tor, and leaves nothing on the host machine. It protects a session on a computer you do not control.

See also: Amnesic System, Persistent Storage, Tor

An explicit statement of what you are protecting, who realistically wants it, what happens if they get it, and how much effort you can sustain. Every tool decision on this site follows from it, because the right answer changes completely with the adversary.

See also: OPSEC, Compartmentalization, Anonymity Set

A volunteer-operated onion routing network that relays traffic through three relays so that no single one knows both who you are and where you are going. It is the strongest widely available protection against network-level identification, and it does nothing about what you disclose to the site you reach.

See also: Onion Routing, Exit Node, Entry Guard, Bridge

Deriving information from the pattern of communication — sizes, timing, direction, frequency — without reading any contents. Encryption does not defeat it, which is why metadata resistance is a separate design goal from confidentiality.

See also: Metadata, Correlation Attack, Mix Network

Requiring a second proof of identity alongside a password. The factors differ sharply in strength: an SMS code can be intercepted or reassigned by a carrier, while a hardware key resists phishing outright.

See also: Hardware Security Key, Password Manager

A boot process in which each stage cryptographically checks the next, so tampering with the operating system is detected rather than silently accepted. Custom Android distributions preserve it by relocking the bootloader against their own signing key.

See also: GrapheneOS, Full-Disk Encryption

A tunnel that routes traffic through a provider's server, hiding the destination from the local network and the origin from the destination. It relocates trust to the provider rather than removing the need for it, and it does not affect anything measured inside the browser.

See also: No-Logs Policy, Kill Switch, DNS Leak, Browser Fingerprinting

A regularly republished statement that a provider has not received a particular class of secret legal demand, on the theory that ceasing to publish it is not itself compelled speech. Its legal weight is untested in most jurisdictions.

See also: No-Logs Policy

Disclosure of a device's real IP address by the browser's real-time communication APIs, which enumerate local network interfaces and can bypass a proxy or tunnel. It defeats an otherwise correctly configured VPN or proxy setup.

See also: DNS Leak, VPN, Browser Fingerprinting

A service architecture in which stored data is encrypted with keys the provider does not hold, so it cannot read the contents even under compulsion. It is a claim about key custody, and it should be read alongside what metadata the provider still holds.

See also: End-to-End Encryption, Metadata