Cactus
Safe software we recommend
Trustworthy picks, favouring free and open-source options - for your passwords, messages, browsing, files, and devices. Every link goes to the official site.
Build a Windows install script
Tick the apps you want below and we'll generate one script that installs them all with winget, Microsoft's built-in package manager. We host nothing - winget downloads each app from its official source.
No apps selected yet.
Tick "Add to install script" on the apps you want, then copy the script from here.Windows 10 and 11 include winget. Paste the script into PowerShell or Terminal and press Enter. Always review a script before you run it.
Version numbers last checked 2026-09-01. The script never asks for a specific version - winget always installs whatever is current on the day you run it.
Start with these
Password managers
Generate and store a unique password for every account so one breach can never cascade.
Bitwarden
Full-featured, audited, and works on every platform. The free tier covers most people.
KeePassXC
An offline vault stored as a file you control - no cloud account required.
1Password
Polished and family-friendly. Paid only, but widely trusted and easy for non-technical users.
KeePassDX
Opens the same KeePassXC vault file on an Android phone, so an offline vault is not stuck on one computer.
Android only.
Proton Pass
From the makers of Proton Mail - open-source, with built-in 2FA and email aliases. Solid free tier.
Two-factor authentication apps
Generate the 6-digit codes that add a second lock to your accounts. Safer than text-message codes.
Ente Auth
Cross-platform, open-source, with encrypted backups so you do not lose your codes.
Aegis Authenticator
A well-regarded open-source authenticator for Android.
Android only.
Proton Authenticator
Open-source code app that also runs on Windows, so your codes are not trapped on one phone. Works with or without a Proton account.
Newer than the others here - launched in 2025.
2FAS
Open-source authenticator for iPhone and Android, with optional encrypted backup.
Anti-malware
Protection against viruses and malware. You likely already have a capable option built in.
Microsoft Defender
Built into Windows 10 and 11 and genuinely good - just keep real-time protection on.
Already included with Windows; no install needed.
Malwarebytes
A trusted second-opinion scanner; the free version cleans up infections on demand.
AdwCleaner
A free one-shot cleaner from Malwarebytes that removes adware, toolbars and browser hijackers - the junk you pick up from a fake download site.
Run it once when something feels wrong; it is not an always-on scanner.
Keeping your software up to date
Most break-ins use a hole that was already fixed - in an update nobody installed. These find the apps that have fallen behind so you do not have to check each one by hand.
Windows Package Manager (winget)
Already on your PC. One command - winget upgrade --all - updates every app it installed, in one pass. It is also what the install script above uses.
Built into Windows 10 and 11; nothing to install.
UniGetUI
A plain window on top of winget: it lists every app with an update waiting and installs them when you click. No commands to type.
Formerly called WingetUI.
Patch My PC Home Updater
Scans the programs you already have, tells you which are out of date, and updates them. Free for home use.
Browsing the web
Web browsers
Your browser is your front door to the web - these put privacy and security first. Looking for Chrome or Edge? They are not privacy picks, so they sit further down under "Popular downloads, from the real source", with the address the real installer comes from.
Mozilla Firefox
Independent, open-source, with strong built-in tracking protection.
Brave
Chromium-based with ads and trackers blocked by default.
Optional crypto features can be turned off.
Mullvad Browser
A privacy-hardened browser from Mullvad and the Tor Project - strong anti-fingerprinting, without needing the Tor network.
Desktop only.
Tor Browser
Routes your traffic through the Tor network for anonymity. Slower, but the strongest option for sensitive browsing.
LibreWolf
A Firefox fork hardened for privacy out of the box, with no telemetry - maximum privacy with minimal setup.
Ad and tracker blockers
Blocking ads and trackers also blocks a common path for malware ("malvertising").
uBlock Origin
The gold-standard, lightweight, open-source content blocker. Works in Firefox and Brave.
Chrome and Edge can no longer run it - use the Lite version below.
uBlock Origin Lite
The same author's smaller blocker for Chrome and Edge, which no longer allow the full version. It blocks less, but it is the honest choice on those browsers.
Privacy Badger
A set-and-forget tracker blocker from the EFF that learns to block hidden trackers as you browse. Pairs well with uBlock Origin.
Private search engines
Search engines that don't profile you or build an advertising dossier from your queries.
DuckDuckGo
The best-known private search engine - no tracking and no search-history profile.
Brave Search
An independent search index (not a Bing or Google reskin) with a privacy focus.
Startpage
Google results without the tracking, proxied through Startpage.
Based in the Netherlands.
Secure DNS and filtering
DNS is how your device looks up websites. A filtering resolver can block malicious and tracking domains for your whole network.
NextDNS
Cloud DNS filtering that blocks malware, trackers, and ads across all your devices. Generous free tier.
Quad9
A free public DNS resolver that blocks known malicious domains. Just change one setting.
Nonprofit, based in Switzerland.
A fast, free public DNS that can block malware (1.1.1.2) or malware plus adult content (1.1.1.3). Simple to set up.
CIRA Canadian Shield
Free DNS filtering from the Canadian nonprofit that runs .ca domains, using the federal Cyber Centre's list of malicious sites. A Family setting also blocks adult content.
Servers are in Canada; CIRA publishes a no-retention policy.
Messages and email
Private messaging
End-to-end encrypted messaging so only you and the recipient can read your conversations.
Signal
The benchmark for private messaging - open-source, nonprofit, and end-to-end encrypted by default.
SimpleX Chat
A newer open-source messenger with no user IDs or phone numbers at all - the most metadata-private option.
Newer, with a smaller community than Signal.
Jitsi Meet
Free group video calls in the browser, with no account and nothing to install - useful when someone asks you to install a meeting app just to talk once.
Calls are private but not end-to-end encrypted by default; for a sensitive conversation use Signal.
Briar
Peer-to-peer encrypted messaging with no central servers - it can sync over Tor or even directly by Wi-Fi, so it keeps working when networks are blocked.
Android only; aimed at activists and high-risk users.
Private email
Encrypted email providers that do not mine your inbox for advertising.
Proton Mail
Encrypted email with a usable free tier.
Based in Switzerland (strong privacy laws).
Tuta
Encrypted email and calendar, open-source, with a free tier.
Based in Germany.
Mailbox.org
A privacy-respecting paid email and office suite, popular in Europe.
Based in Germany.
Email aliases
Hide your real email behind unique aliases you can disable anytime - great against spam and after data breaches.
SimpleLogin
Open-source email aliasing from Proton. Create a unique address for every site and shut off spam at the source.
addy.io
Open-source anonymous email forwarding with a generous free tier (formerly AnonAddy).
Firefox Relay
From Mozilla, the makers of Firefox: throwaway addresses that forward to your real inbox and can be switched off one at a time.
Needs a Mozilla account.
A free @duck.com address that forwards to your real inbox and strips hidden trackers out of the mail on the way through.
You sign up from the DuckDuckGo browser or its extension.
Encrypted notes
Note apps that encrypt your content so only you can read it, synced across your devices.
Standard Notes
End-to-end encrypted notes, independently audited, with a long-term focus on durability.
Joplin
Open-source notes and to-dos with optional end-to-end encryption and your choice of sync.
Notesnook
Open-source notes that are encrypted by default, with a friendlier app than most privacy note tools. Free for personal use.
Files, backups and everyday apps
Backup
Regular backups are the single best defence against ransomware and lost or broken devices. Keep at least one copy offline or in the cloud.
Duplicati
Open-source, encrypted, scheduled backups to almost any cloud or drive.
Veeam Agent (Free)
Free, reliable full-image backup for Windows - restore your whole system after a failure.
Kopia
Open-source encrypted backups with an actual window to click, sitting between Duplicati and the command-line tools.
Restic
Fast, open-source, encrypted backups to a local disk, SFTP, or almost any cloud. Command-line, but rock-solid and widely trusted.
Encrypted cloud storage
Cloud storage where files are encrypted before they leave your device, so the provider cannot read them.
Proton Drive
End-to-end encrypted cloud storage from Proton, with a free tier.
Based in Switzerland.
Ente Photos
End-to-end encrypted photo backup - a private alternative to Google Photos or iCloud.
Syncthing
Keeps a folder in step across your own computers and phones directly, with no cloud account in the middle and nothing stored on anyone else's server.
Deliberately not in the install script: the Windows download is a plain zip, and setting it up takes a bit of patience.
Sync.com
Canadian-owned storage that keeps your files in Canadian data centres and encrypts them so Sync itself cannot read them - including on the free 5 GB plan.
Closed source. Canada is part of Five Eyes, so this is about where your files live, not about being out of reach.
File and disk encryption
Lock files, folders, or whole drives so they are unreadable without your password - essential if a device is lost or stolen.
VeraCrypt
Create encrypted containers or encrypt entire drives. The trusted successor to TrueCrypt.
Cryptomator
Encrypts your files before they sync to Dropbox, Google Drive, or any cloud.
Picocrypt
A tiny open-source tool that does one thing: lock a single file or folder with a password before you email or upload it.
BitLocker
Full-disk encryption built into Windows Pro - turn it on to protect a lost or stolen laptop.
Built into Windows Pro/Enterprise; on macOS, turn on FileVault.
Secure file sharing
Send a file or a secret so only the recipient can open it - not the service in the middle.
OnionShare
Share files, host a simple site, or chat directly over the Tor network - no third party ever holds your data.
Bitwarden Send
Send an encrypted note or file with a link that can expire after a set time or a single view - from the makers of the Bitwarden password manager.
Popular downloads, from the real source
Searching for these by name is riskier than it looks: the top result is often a paid ad pointing at a lookalike site that wraps the real program in adware. Every link here goes to the official home of the app.
7-Zip
Opens zip, 7z, rar and almost any other archive, and creates zip and 7z. Useful for safety too: you can look inside an attachment before you extract it.
VLC media player
Plays practically any video or audio file, so you never need one of the "codec packs" that have carried adware for twenty years.
Thunderbird
A free email program from the makers of Firefox. It shows the real sender address next to the display name, which makes a spoofed "from" much easier to catch.
SumatraPDF
A small, fast PDF reader. A lighter alternative to Adobe Reader, which attackers target precisely because it is on every machine.
Notepad++
A text editor that opens log files and settings files without mangling them - handy when someone walks you through a fix.
Google Chrome
The browser most people already use. If you are going to install it, this is the only address it should come from - fake Chrome installers are the most common of all.
LibreOffice
A free replacement for Word, Excel and PowerPoint that opens and saves the same files.
Large download (about 350 MB).
Microsoft 365
Word, Excel and Outlook come from your own Microsoft account, and there is a free version that runs in the browser. Searching for a "free download" instead is how people end up running an activator that is really malware.
Deliberately not in the install script: the winget package is the business edition and will not activate for a household.
GIMP
A free image editor in the same league as Photoshop. A search ad once showed gimp.org and sent people to a look-alike handing out password-stealing malware.
Greenshot
Take a picture of part of your screen and mark it up - handy for showing someone the scam message you received. It saves to your own computer, nowhere else.
Audacity
Free audio recording and editing - for digitising old tapes or trimming a voice memo.
OBS Studio
The free screen-recording and streaming program, and another name that turns up in fake download ads.
NAPS2
Scan documents straight to PDF from almost any scanner or all-in-one printer, without installing the manufacturer's bundled software.
Remote help and advanced
Remote help and screen sharing
Useful when someone you trust needs to see your screen to help you. It is also the number-one tool of tech-support fraud, so read the warning before you install any of them.
Windows Quick Assist
Already on your PC: press the Windows key and type "Quick Assist". The best choice for family help, because there is nothing to download and it closes when you close the window.
Built into Windows 10 and 11; nothing to install.
TeamViewer
The best-known remote-support tool, free for personal use. It hands over full control of your computer - which is exactly why fraudsters ask for it by name.
Free for personal use; a paid licence is required for business.
AnyDesk
Light and quick, free for personal use. Treat it with the same caution as TeamViewer.
Tailscale
Links your own devices into a private encrypted network, so you can reach your home computer from anywhere without opening a port on your router - the thing that gets people ransomwared.
Not a privacy VPN - it does not hide your browsing from your provider. The apps are open source; the service that connects them is not.
RustDesk
An open-source alternative you can point at your own server, so nobody else's service ever relays your screen.
Self-hosting is optional, and is the main reason to pick it.
Chrome Remote Desktop
You connect from a browser tab with your Google account. The computer being controlled installs a small host component; the one you connect from needs nothing.
VPNs
A VPN hides your IP from websites and your traffic from your local network - but it is not anonymity, and you are trusting the provider. Choose a reputable no-logs service and avoid "free" VPNs that monetize your data.
Proton VPN
Open-source apps and the only reputable VPN with a genuinely unlimited free tier.
Based in Switzerland; independently audited.
Mullvad
Privacy-first, flat-rate, and you can sign up without an email address.
IVPN
Privacy-focused, open-source apps, independently audited, with no-logs and anonymous sign-up.
Disk, hardware and repair
Free tools for the ordinary questions: where did my disk space go, is this drive about to fail, what is that program actually doing, and how do I make a Windows install USB from Microsoft's own file instead of a stranger's.
WinDirStat
Shows where your disk space actually went, as a map you can read at a glance instead of a list of folders.
HWiNFO
Reads your hardware's own health reporting - drive SMART status, temperatures, battery wear - so you can spot a failing drive before it takes your files with it.
Free for personal use.
Rufus
Turns an official Windows or Linux ISO into a bootable USB stick - the right way to reinstall, instead of downloading a ready-made image from somewhere you have never heard of.
Everything
Finds any file by name almost instantly, which is how you check whether that document really is where you think it is.
Process Explorer
Microsoft's detailed Task Manager: shows what each running program actually is, and can check every one of them against VirusTotal in a couple of clicks.
Privacy-focused operating systems
For higher-risk needs: operating systems built around security and privacy from the ground up.
GrapheneOS
A hardened, de-Googled version of Android with a strong security track record.
Installs on Google Pixel phones.
Tails
A live operating system you run from a USB stick; it routes everything through Tor and leaves no trace on the computer.
Runs from a USB stick.
Qubes OS
A desktop OS that isolates your activities in separate virtual machines, so one compromised app cannot reach the rest.
Advanced; needs capable hardware.