Open Source Privacy Tools: Complete List 2026

"Open source" is a verifiable claim — which means a list like this one is only worth publishing if someone actually verifies it. So in July 2026 we re-checked every tool on this page: license (OSI-approved or out), maintenance (a release or significant activity within 12 months), and governance (acquisitions, license changes, funding crises, project-status announcements). Several entries changed as a result, and we've said so rather than quietly rewording.

That's also the honest pitch for open source itself: proprietary apps can promise zero tracking while quietly phoning home; public code can be checked. What follows is 34 tools across 11 categories that passed verification — plus, at the end, the open-source stack we run ourselves, because a list like this from a company that doesn't practice it would be decoration.

Updated 18 October 2026: we corrected the Pulse entry (the dashboard and tracker are open source, the backend runs as a managed service) and its script size, removed Nomad from the stack we run, and now describe Tessera as SDKs and a sidecar around opaque-ke.

Update, 19-07-2026 — full re-verification of every entry. Notable changes: Session survived a serious funding crisis (note added), Briar entered maintenance mode, Bitwarden's enterprise modules moved to a source-available license (core stays open), Mullvad completed its OpenVPN retirement. Added: SimpleX Chat, Immich, Ente, Pi-hole, AdGuard Home, and a new DNS-blocking category.

How We Verified This List

Four criteria, applied to every entry in July 2026:

• Genuinely open source: an OSI-approved license (GPL, MIT, Apache, AGPL, MPL) for the product as you'd actually run it. Source-available licenses (BUSL, SSPL) don't qualify — see the FAQ for why that distinction has teeth.
• Active within 12 months: at least one release or significant development activity. Projects in formal maintenance mode are marked as such, not silently kept.
• Usable without expertise: a non-technical person should be able to install and use it (underlying protocols like WireGuard excepted).
• Governance noted: acquisitions, license moves, funding trouble, and controversies get a clause, not a cover-up. Trust survives bad news; it doesn't survive discovering the list glossed over it.

Three tools on this list are ours (Pulse, and two entries in the "what we run" section). They're labeled. No tool paid for placement.

What Are the Best Open Source Encrypted Messaging Apps?

Signal — Best for Everyday Private Messaging

Signal remains the gold standard: end-to-end encryption by default for messages, calls, and video, with the Signal Protocol so battle-tested that WhatsApp and Google Messages adopted it. Signal itself stores virtually no metadata — subpoena responses have shown account-creation date and last-connection date, nothing more. It's the team default at Ciphera.

License: AGPL-3.0 · Country: US · Cost: Free · Platforms: All

SimpleX Chat — Best for No-Identifier Messaging

SimpleX goes a step further than everyone else in this category: no phone number, no email, and — uniquely — no user identifiers of any kind, not even random ones. Message queues are unidirectional and disposable, so there's no stable "you" for servers to correlate. Actively developed and audited; the most interesting new entrant since our last revision.

License: AGPL-3.0 · Country: UK · Cost: Free · Platforms: iOS, Android, desktop

Element (Matrix) — Best for Decentralized Team Communication

Element runs on the Matrix protocol — a federated network where you control your own server. The French and German governments run internal messengers on Matrix (Tchap, BwMessenger). If any single operator disappears, the network keeps running.

License: AGPL-3.0 / GPL-3.0 (commercial licensing available) · Country: UK · Cost: Free self-hosted; hosted plans available · Platforms: All

Session — Best for Anonymous Messaging

Session requires no phone number or email, and routes messages through an onion network that hides metadata even from relay servers. One honest note from our verification: the foundation behind it nearly shut down in mid-2026 after a funding crisis, surviving on roughly $1M in community donations. The project is alive and shipping, but running leaner than before — worth knowing if you're betting a workflow on it.

License: GPL-3.0 · Country: International (foundation) · Cost: Free · Platforms: All

Briar — Best for Extreme Conditions

Briar syncs peer-to-peer over Bluetooth or Wi-Fi — no internet required, no servers at all — which makes it unique for internet shutdowns and extreme-risk situations. Verification note: Briar formally entered maintenance mode in July 2026 (security fixes only, no new features). For its niche, that's acceptable; for a daily driver, pick Signal or SimpleX.

License: GPL-3.0 · Country: UK · Cost: Free · Platforms: Android

What Are the Best Open Source Private Email Providers?

Proton Mail — Best for Encrypted Email

Proton Mail offers end-to-end encryption between Proton users and zero-access encryption for stored mail, under Swiss jurisdiction, with fully open-source clients. Over 50,000 business customers as of 2026. It's the benchmark for private email, and what several of us use personally.

License: GPL-3.0 (clients) · Country: Switzerland · Cost: Free tier; paid from $3.99/mo · Platforms: All

Tuta — Best for Post-Quantum Email

Tuta has run hybrid post-quantum encryption (TutaCrypt) in production since 2024 — earlier than nearly anyone — and encrypts subject lines, which Proton doesn't. German-hosted and expanding (a government-grant-funded encrypted drive is in beta).

License: GPL-3.0 · Country: Germany · Cost: Free tier; paid from EUR 3/mo · Platforms: All

Thunderbird — Best Desktop Email Client

Thunderbird keeps a local, open-source client viable in a webmail world: any provider, built-in PGP, active 2026 roadmap (Exchange support, database overhaul) under Mozilla subsidiary MZLA.

License: MPL-2.0 · Country: US · Cost: Free · Platforms: Windows, macOS, Linux

What Are the Best Open Source Encrypted File Sharing Tools?

Send — Best for Self-Hosted File Transfers

Send is the community fork of Mozilla's discontinued Firefox Send: end-to-end encrypted transfers with expiring links, self-hostable. Caveat from verification: the flagship public instance is a single-maintainer community project — self-host it if you need it to exist next year.

License: MPL-2.0 · Country: Netherlands (maintainer) · Cost: Free self-hosted · Platforms: Web

OnionShare — Best for Anonymous File Sharing

OnionShare serves files directly from your machine over Tor — no server ever holds the file, and the share vanishes when you close the app. Still actively released.

License: GPL-3.0 · Country: International · Cost: Free · Platforms: Windows, macOS, Linux

What Are the Best Open Source Privacy-First Analytics Tools?

For the detailed comparison of this category, see Pulse vs Google Analytics vs Plausible vs Fathom.

Pulse — Best for Zero-Cookie Analytics

Pulse — ours, so judge accordingly — collects website analytics with no cookies, no fingerprinting, and no personal data. The dashboard and tracking script are open source, while the backend runs as a managed service. The script is under 3 KB gzipped, data lives in Switzerland, and in our view Pulse needs no consent banner.

License: AGPL-3.0 (dashboard and tracker) · Country: Belgium (company) / Switzerland (data) · Cost: Free tier · Platforms: Web

Plausible — Best Lightweight Analytics

Plausible pioneered the category: a sub-2 KB script, simple dashboard, EU hosting, no cookies. The Community Edition is self-hostable.

License: AGPL-3.0 · Country: Estonia · Cost: From $9/mo cloud; free self-hosted · Platforms: Web

Umami — Best for Self-Hosted Simplicity

Umami is MIT-licensed, deploys via Docker in minutes, and has become the default "just give me pageviews on my own server" choice.

License: MIT · Country: US · Cost: Free self-hosted · Platforms: Web

Matomo — Best Full Google Analytics Replacement

Matomo is the mature heavyweight: funnels, heatmaps, tag management — the full GA feature set with complete data ownership.

License: GPL-3.0 · Country: New Zealand · Cost: Free self-hosted; cloud from EUR 23/mo · Platforms: Web

What Are the Best Open Source VPN and Network Privacy Tools?

Mullvad — Best No-Nonsense VPN

Mullvad completed its OpenVPN retirement in January 2026 and now runs WireGuard-only. EUR 5/month flat, no email required, cash accepted by post, apps open source and independently audited, and a documented history of having nothing to hand over.

License: GPL-3.0 (apps) · Country: Sweden · Cost: EUR 5/mo · Platforms: All

ProtonVPN — Best Free-Tier VPN

ProtonVPN's free tier has no data caps and no ads — genuinely usable rather than a crippled demo — and Secure Core multi-hops traffic through hardened data centers.

License: GPL-3.0 (apps) · Country: Switzerland · Cost: Free tier; paid from $4.99/mo · Platforms: All

WireGuard — Best VPN Protocol

WireGuard is the protocol underneath the good VPNs: ~4,000 lines of code versus 100,000+ for OpenVPN, in the Linux kernel since 5.6. If you run your own server, this is the primitive to build on.

License: GPL-2.0 · Country: — · Cost: Free · Platforms: All major OS

What Are the Best Open Source Privacy Browsers?

Firefox — Best Independent Browser

Firefox remains the only major browser whose engine isn't Chromium — an independence that matters for the whole web, not just your tabs. Worth one clause of honesty: Mozilla's early-2025 Terms-of-Use wording sparked a real backlash before being walked back; the product's tracking protection is unchanged and strong.

License: MPL-2.0 · Country: US · Cost: Free · Platforms: All

Tor Browser — Best for Anonymity

Tor Browser routes traffic through three relays with fingerprinting defenses layered on Firefox ESR. Slower, by design, in exchange for genuine anonymity. Note: US government funding cuts in 2025 hit the project's budget — the software is unaffected, but it has never needed community support more.

License: BSD-3-Clause (Tor) / MPL-2.0 (browser base) · Country: US (non-profit) · Cost: Free · Platforms: Windows, macOS, Linux, Android

Brave — Best Privacy-by-Default Browser

Brave blocks ads and trackers out of the box on a Chromium base (full extension compatibility), with 100M+ monthly users as of late 2025. Its crypto features are ignorable if they're not your thing.

License: MPL-2.0 · Country: US · Cost: Free · Platforms: All

LibreWolf — Best for Firefox Purists

LibreWolf is Firefox with every telemetry and sponsorship surface removed, tracking Firefox ESR within days of each release.

License: MPL-2.0 · Country: — · Cost: Free · Platforms: Windows, macOS, Linux

What Are the Best Open Source Password Managers?

Bitwarden — Best Overall Password Manager

Bitwarden is cross-platform, regularly audited, self-hostable, and the free tier genuinely covers individual use. Verification nuance: the core clients and server remain GPL/AGPL, but newer enterprise modules ship under a source-available "Bitwarden License," and January 2026 brought a steep premium price hike — on top of private-equity investment taken back in 2022. The open-source core is unaffected today — we're noting the trajectory, not sounding an alarm.

License: AGPL-3.0 (server), GPL-3.0 (clients), source-available enterprise modules · Country: US · Cost: Free; premium $10/yr · Platforms: All

KeePassXC — Best Offline Password Manager

KeePassXC keeps your vault in an encrypted local file you control — no cloud, no account, no company. Pair with Syncthing or Nextcloud for multi-device sync on your own terms.

License: GPL-2.0 / GPL-3.0 · Country: — · Cost: Free · Platforms: Windows, macOS, Linux

What Are the Best Open Source Cloud Storage and Photo Tools?

Nextcloud — Best Self-Hosted Cloud Platform

Nextcloud is the full Google-Workspace replacement — files, calendar, video calls, document editing — self-hosted, with strong momentum from European governments' sovereignty push in 2025–2026.

License: AGPL-3.0 · Country: Germany · Cost: Free self-hosted; enterprise plans · Platforms: All

Cryptomator — Best Encryption Layer for Any Cloud

Cryptomator adds client-side encryption on top of whatever cloud you already use — the vault syncs like a normal folder, but the provider sees only ciphertext.

License: GPL-3.0 · Country: Germany · Cost: Free desktop; paid mobile · Platforms: All

Immich — Best Self-Hosted Photo Library

Immich is the credible self-hosted Google Photos replacement — mobile backup, timeline, search, face grouping — developed full-time under the FUTO umbrella and improving at a startling pace. The standout addition to this list in 2026.

License: AGPL-3.0 · Country: US (FUTO) · Cost: Free self-hosted · Platforms: Server + iOS/Android

Ente — Best Encrypted Photo Cloud

Ente offers end-to-end encrypted photo storage if you'd rather not run a server — and its companion app, Ente Auth, is an excellent open-source 2FA authenticator, filling a category this list previously lacked.

License: AGPL-3.0 · Country: India · Cost: Free tier; paid plans · Platforms: All

What Are the Best Open Source DNS-Level Blockers?

New category this revision — network-level blocking protects every device behind it, including the ones (TVs, IoT) that can't run a browser extension.

Pi-hole — Best for the Home Network

Pi-hole sinkholes ad and tracker domains for your entire network from something as small as a Raspberry Pi. The classic homelab first project, still actively maintained.

License: EUPL-1.2 · Country: — · Cost: Free · Platforms: Linux (incl. Raspberry Pi)

AdGuard Home — Best Polished Self-Hosted DNS Filter

AdGuard Home covers the same ground as Pi-hole with a more polished UI and built-in encrypted DNS (DoH/DoT) upstream support. The Home product is fully open source (the company also sells proprietary apps — don't conflate them).

License: GPL-3.0 · Country: Cyprus · Cost: Free · Platforms: Linux, macOS, Windows, ARM

What Are the Best Open Source Private Operating Systems?

GrapheneOS — Best Secure Mobile OS

GrapheneOS hardens Android for Pixel devices — memory-safety mitigations, sandboxed Google Play compatibility, no Google services by default. It gained its first major OEM partnership in 2026, a strong signal for longevity.

License: MIT / Apache-2.0 · Country: Canada · Cost: Free · Platforms: Google Pixel

Tails — Best Amnesic Live OS

Tails boots from USB, routes everything through Tor, and forgets everything at shutdown. Actively released (7.x series through 2026), and still what journalists reach for.

License: GPL-3.0+ · Country: — · Cost: Free · Platforms: Any PC via USB

QubesOS — Best Compartmentalized Desktop

QubesOS isolates every application in its own virtual machine — a compromise in one compartment stays in that compartment. Demanding, and worth it for high-risk work. 4.3 shipped in December 2025, with 4.3.1 following in June 2026.

License: GPL-2.0 · Country: Poland (origin) · Cost: Free · Platforms: x86 desktops

What Are the Best Open Source Private Search Engines?

SearXNG — Best Self-Hosted Search

SearXNG aggregates results from dozens of engines without any of them knowing who searched. Run your own instance or use a public one.

License: AGPL-3.0 · Country: — · Cost: Free · Platforms: Web (self-hosted or public instances)

Brave Search — Best Independent Index

Brave Search built its own index — no Google or Bing dependency, a feat only a handful of companies have managed — and it's now genuinely independent at 40B+ pages. The index is proprietary; it earns its slot here for independence and no user tracking, clearly labeled.

License: Proprietary index, open-source browser · Country: US · Cost: Free; premium $3/mo · Platforms: Web

The Open-Source Stack We Run Ourselves

A list like this is cheap if the publisher's own stack is a black box. Ours is partly open: the Pulse dashboard and tracker, Tessera and Sigil are public, while the Pulse backend runs as a managed service. What Ciphera ships and runs:

And the honesty beat, because the source-available distinction cuts against us too: we also run HashiCorp Vault, which is BUSL-licensed (source-available, not open source), and Teleport, whose repository is AGPL but whose binaries carry usage restrictions since v16. We know the difference, we count them accordingly, and they're on the long-term replacement list. If a vendor's "open source" page doesn't make these distinctions, that tells you something about the rest of the page.

Which Three Should You Start With?

You don't need 34 tools. Start with Signal for messaging, Bitwarden for passwords, and Brave or Firefox for browsing — the three categories where the most personal data actually leaks, all free, all installable this afternoon.

From there: Proton Mail for email, Pi-hole for the whole household, Nextcloud when you're ready to own your cloud. Every claim on this list can be checked against public sources, and where part of a product is closed (for example Brave Search's index or Pulse's backend) the entry says so. That is the entire point: privacy you don't have to take on faith.