The five projects below are worth assessing as part of a Windows setup, provided they are deployed for the right job. The practical theme is restraint: enable and test protections that address a defined risk, preserve recovery options, and be especially sceptical of tools that promise a one-click hardening or irreversible deletion result.
1. Bitwarden: a strong starting point for password hygiene
Bitwarden addresses one of the most common security failures: relying on memorable, repeated passwords. Its design is described as zero knowledge: vault data is encrypted before it is stored, and the user holds the keys required to decrypt it. In practical terms, that makes a password manager a better starting point than attempting to invent and remember a different high-quality password for every account.
The current free offering is also more useful than an old “two-device” description suggests. Bitwarden says users can store unlimited passwords and access them on any device. For a Windows user who also signs in on a phone, tablet, or another PC, that matters: the security benefit of a password manager is diminished if it is convenient on only one machine.
There is meaningful public assurance, but it should be understood accurately. Bitwarden says it conducts recurring third-party audits involving source-code assessments and penetration testing, and its published inventory includes the 2018 Cure53 assessment along with later reports. Recurring review is a valuable signal, particularly for software handling a credential vault. It is not, however, a permanent guarantee against flaws, compromised endpoints, phishing, or a user losing control of their account.
The open-source label needs a qualification as well. Current Bitwarden documentation distinguishes repository source code covered by AGPLv3 from code covered by Bitwarden License v1.0. The Bitwarden-Licensed material is source-available rather than OSI-approved open source. Users who value transparent code should therefore distinguish AGPL-covered code from source-available components that carry different licensing terms.
For a new Windows setup, Bitwarden is most valuable when it becomes the default place for unique account credentials rather than merely another app containing a few important passwords. The important operational question is recovery: before migrating valuable accounts, make sure the account-recovery approach is understood and that access is not dependent on a single Windows installation or one device.
2. VeraCrypt: system encryption with a real recovery trade-off
VeraCrypt can encrypt a Windows system partition or an entire system drive on the fly. Its documentation specifically says that system encryption covers temporary files, hibernation files, swap files, logs, and registry data located on the encrypted system partition. That is significant because sensitive material is not limited to the documents a user deliberately saves in a folder.
This makes VeraCrypt a serious option for users whose primary concern is a lost or stolen PC and who want its system-encryption approach. It should not be presented as automatically superior to BitLocker merely because it is open source or because it supports pre-boot system encryption. The appropriate choice depends on the recovery model and on what the owner can support over the life of the device.
Microsoft says that in most situations a BitLocker recovery key is backed up automatically when BitLocker is first activated. For consumer users, it is typically associated with their Microsoft account; for managed devices, it is typically backed up by the organization. That can be a benefit when a recovery event occurs: it provides a route back into an encrypted device. It is also a material consideration for people who specifically want to minimize reliance on an online account or an employer-held recovery process.
VeraCrypt has had independent scrutiny, including a Quarkslab audit released in 2016 that involved 32 person-days of study. The audit itself stressed the need for regular evaluations of complex security projects. That is the right interpretation of an old audit: it is useful evidence that the project was examined, not a blanket certification of every later build, setting, or deployment.
Technical shorthand can mislead here. VeraCrypt 1.26.29, released June 9, 2026, identifies Argon2id as an alternative key-derivation function for non-system volumes and removes RIPEMD-160. That does not mean Argon2id applies to Windows system encryption: current VeraCrypt documentation says system encryption uses PBKDF2-HMAC. The distinction matters because volume-encryption options and pre-boot Windows system encryption are not interchangeable configuration choices.
For Windows owners, encryption should be installed only alongside a recovery plan that is both secure and usable. Encryption without a recoverable path can turn a routine hardware, firmware, or sign-in problem into permanent loss of the machine’s data. Conversely, a recovery key held in an online account or by an organization is a deliberate convenience-versus-control trade-off, not an implementation detail to ignore.
3. Portmaster: visibility and outbound rules, not malware immunity
Portmaster is a free, open-source application firewall that lets users monitor network connections and apply rules on a per-application basis. It also offers system-wide DNS-level tracker blocking. For a newly installed Windows system, that visibility can be useful: software that has just been added can be observed and constrained according to which connections the user considers appropriate.
Its Windows implementation is not merely a superficial desktop overlay. The project uses a kernel-mode driver for high-performance operating-system integration through the Windows Filtering Platform. This underlines why a network-control product should be evaluated with the same care as other privileged system software: it is designed to operate deeply enough in Windows to observe and influence network traffic.
The key limit is scope. Portmaster’s own documentation says its bypass-prevention option is mainly intended to prevent cooperative software from circumventing protection and is not aimed at malware specifically built to evade it. That means its tracker blocking, DNS controls, and app-level rules should not be framed as a substitute for general malware defences. A malicious program may be adversarial in a way that ordinary applications are not.
That distinction has a practical consequence. Portmaster may help a user discover and control normal application behavior, but a prompt to allow or block a connection still requires judgement. Broadly allowing unknown software because a connection prompt is inconvenient defeats the value of application-level controls. Equally, blocking a program without understanding its role can create failures that look like random Windows or application instability.
A sensible rollout is to use connection visibility to learn the machine’s ordinary pattern first, then set rules for applications where the desired policy is clear. Treat the firewall as a control and diagnostic lens—not as evidence that every allowed application is trustworthy or every blocked threat is neutralized.
4. Win11Debloat: privacy changes that can alter security posture
Win11Debloat is an MIT-licensed PowerShell script intended to remove preinstalled apps and disable telemetry, tracking, ads, and selected Windows features. It can be attractive on a new machine because it consolidates changes that would otherwise require many manual settings adjustments. The project says many changes can be reverted and that most removed apps can be restored through Microsoft Store.
Those capabilities do not make it uncomplicated security hardening. Its documented feature set includes disabling BitLocker automatic device encryption, and the maintainer explicitly warns users to use it at their own risk. That feature alone is enough to reject the idea that every debloating action necessarily improves a PC’s security.
The risk is not limited to the script’s intent. “Telemetry,” “tracking,” and “preinstalled apps” are broad labels that can encompass functions a particular user or organization may need. A change may improve privacy preferences while reducing recoverability, disabling a wanted feature, or making later troubleshooting harder. The fact that many actions are reversible is useful, but “generally reversible” is not the same as risk-free or guaranteed to restore an earlier state exactly.
The safer mindset is to treat Win11Debloat as a configuration tool, not a first-day ritual. Review individual options and preserve a clear record of what was changed. Most importantly, do not disable or remove encryption-related functionality until the device’s encryption and recovery strategy has been chosen deliberately. In a household or workplace, the person who performs the debloat may not be the person who later needs to recover the laptop.
5. Eraser: useful for overwrite tasks, but not an SSD destruction standard
Eraser is a GPLv3 Windows secure-data-removal project. It documents overwrite-based removal, handling for deleted-file residue and NTFS metadata, and a scheduler. Those features can make it useful where the goal is to address particular files or remnants on suitable storage, rather than to replace a full device-retirement process.
What it cannot credibly promise is universal, recovery-proof erasure on every kind of drive. NIST cautions that multiple overwrite passes should be avoided on SSDs with overprovisioning because they provide very little confidentiality protection. Flash wear levelling and spare cells mean ordinary host writes cannot directly address every physical location that may contain data. The same limitation is relevant to modern SSD and NVMe storage expectations: repeatedly writing to what appears to be a location does not demonstrate that every prior physical location was overwritten.
This also makes old references to DoD 5220.22-M or Gutmann multi-pass patterns poor decision rules. NIST notes that the Department of Defense removed overwrite specifications from NISPOM in 2006. Current thinking is to match the sanitization method to the medium and the required assurance level, rather than selecting a named overwrite pattern and assuming it is authoritative.
For a Windows user, the distinction is straightforward. Eraser can be relevant for overwrite and cleanup tasks on media where that technique fits the objective. It should not be the sole basis for declaring an SSD, flash device, damaged drive, or inaccessible-sector scenario safe to sell, discard, or transfer. The more sensitive the data and the less direct control a user has over the storage medium, the less appropriate a generic multi-pass-wipe promise becomes.
Build a stack around decisions, not slogans
These tools cover different layers, so they should not be judged by the same test. Bitwarden is about safer credential handling. VeraCrypt and BitLocker represent encryption and recovery choices. Portmaster is about visibility and policy for network connections. Win11Debloat is a configuration utility with privacy benefits and possible security regressions. Eraser is an overwrite tool whose limits vary sharply by storage technology.
A good order for a new Windows machine is to settle credentials and encryption recovery before making broad privacy changes, use network controls to understand application behavior rather than to claim malware protection, and reserve erasure decisions for the media involved and the assurance actually needed. The strongest setup is not the one with the most security utilities. It is the one in which each privileged tool has a defined purpose, its limitations are accepted, and recovery has been planned before something goes wrong.