He kept six free tools: Proton VPN, Bitwarden, DuckDuckGo Email Protection, NextDNS, Brave and Cryptomator. The more important point for Windows users is the fine print. Every one of these free tiers has a limit, and whether it works for you depends on whether you will hit that limit. Below, each tool is checked against its vendor's current documentation.
Six tools, six different jobs
These apps don't replace one another. Each one protects a different part of your setup:
| Tool | What it protects | Main free-tier limit |
|---|---|---|
| Proton VPN | Traffic between your device and the VPN server | 1 connection; 10 countries; random server switching |
| Bitwarden | Your passwords | No built-in TOTP codes, file attachments or emergency access |
| DuckDuckGo Email Protection | Your main email address | Forwards mail only; not an encrypted mailbox |
| NextDNS | Domain lookups from every device | 300,000 queries per month |
| Brave | Tracking inside the browser | Signing in still identifies you; strict settings can break some sites |
| Cryptomator | Files you store in the cloud | Mobile apps are read-only for free users |
Summary: Think of this as six layers of protection, not one product that does everything. If you drop a paid tool, make sure the free replacement covers the same layer.
Proton VPN: a capable free plan with less choice
Afolabi starts with the obvious question about any free VPN: who pays for the servers? Proton says paid plans fund the free one, and the free tier is generous. Proton's plan documentation lists unlimited data, servers in 10 countries, one connection at a time, a strict audited no-logs policy, DNS leak protection, IPv6 leak prevention or full IPv6 support depending on platform, and a kill switch or always-on VPN.
The trade-off is control over where you connect. Proton's support documentation says free users are first connected to the fastest free server for their location. The free servers are in the Netherlands, Japan, Romania, Poland, Norway, Switzerland, Singapore, Mexico, Canada and the United States. If you switch servers, Proton picks the next one at random. The first switch has a 45-second cooldown, and every switch after that has a 10-minute cooldown. In the Windows app, the option is under the Countries tab, then Change server, and a countdown timer shows when you can switch again.
Paid Plus adds the full network, which Proton lists as 20,000+ servers in more than 140 countries. It also adds up to 10 simultaneous connections, P2P and BitTorrent support, Secure Core, streaming support, split tunneling and the NetShield ad-blocker.
The audit history is the main reason to trust the no-logs claim. Proton says Securitum has now audited its no-logs policy for the fifth year in a row. According to Proton, the 2026 report found no indication that the examined server infrastructure logged browsing activity, DNS queries, destination services, traffic contents or user-identifiable connection metadata. That finding covers the infrastructure Securitum examined. It does not make you anonymous. If you sign in to Google or Amazon while connected, those sites still know who you are, and Afolabi makes the same point.
Summary: The free plan works well for a coffee-shop or hotel Wi-Fi tunnel. You'll need to pay if you want to choose a specific country, use P2P or connect several devices at the same time.
Bitwarden: free covers the essentials
Bitwarden's free plan does almost everything most people need from a password manager. Free includes unlimited vault items, unlimited devices, synchronization, autofill, password generation, passkeys, encrypted export, mobile, desktop and browser access, and text Bitwarden Sends. Afolabi also notes that the vault is encrypted on your device before it is uploaded. Under Bitwarden's zero-knowledge design, the company does not hold the keys to read it. Free accounts can also share items with one other person through a two-person organization.
Premium adds features that some people will want. Several 2026 comparisons agree that Premium is mainly for TOTP, attachments, Emergency Access, broader reports, extra two-step methods, file Sends, and priority support. The lack of built-in TOTP on the free plan affects your own account security only slightly. Bitwarden Free users can enable two-step login, such as MFA, for their Bitwarden account using an authenticator app or email verification codes. What free users can't do is generate codes for other sites inside the vault.
The Premium price depends on which source you read. One 2026 pricing tracker lists Premium $1.65/mo ($19.80/yr), and another source says Premium jumped to $19.80/year. Some other comparison pages still say about $10 a year. Check Bitwarden's own pricing before you budget for it.
You can also self-host with Vaultwarden, as Afolabi mentions. That makes you the server admin, which means patches, backups and uptime are your responsibility.
Summary: For one person storing, syncing and autofilling unique passwords on Windows, Android and iOS, the free tier is enough.
DuckDuckGo Email Protection: aliases that keep your real address private
This one is the easiest to recommend. DuckDuckGo describes Email Protection as a free forwarding service. It creates unique private addresses, removes several types of hidden email trackers, and forwards messages to the inbox you already use, so you don't have to change providers. You can create private Duck Addresses on demand from DuckDuckGo's apps and extensions or from the Autofill tab in Email Protection settings.
Afolabi gives each store, newsletter or PDF download its own @duck.com address. If one starts attracting spam, he deactivates it and his main address stays out of it. He calls the supply of aliases "effectively unlimited." DuckDuckGo's help pages confirm you can create many addresses on demand, but the pages checked here don't give a number.
DuckDuckGo says it processes messages to strip trackers and then forwards them without storing the emails or their headers. This is not an encrypted mailbox, though. Anything you type into a signup form is still visible to that company.
NextDNS: filtering that reaches beyond the browser
Browser extensions can't see what your smart TV, game console or phone apps are contacting. NextDNS works at the DNS level instead. It can block requests to ad, tracker, malware and telemetry domains before any app reaches them, for every device you point at it.
NextDNS's pricing page lists the free tier as 300,000 queries per month, unlimited devices, unlimited configurations and access to all features. Pro removes the query cap for $1.99 a month or $19.90 a year. If you go over the free quota, NextDNS keeps answering queries like an ordinary DNS resolver. Your internet keeps working, but blocking stops until the counter resets.
A busy household can use up 300,000 queries quickly. Watch the analytics for the first few weeks before you point every device in the house at it. Also keep in mind that DNS filtering can't separate first-party ads served from the same domain as the content you want, and it doesn't hide your identity.
Brave: tracker blocking on by default
Brave says Shields are on by default for every site. They block third-party ads and trackers, partition cookies to stop cross-site tracking, randomize fingerprinting APIs and use CNAME uncloaking to catch trackers that hide behind a site's own subdomains. Brave's blocking draws on EasyList, EasyPrivacy, uBlock Origin lists and its own internal lists.
Brave's own technical write-up adds a limit worth knowing. A February 2026 update clarifies that CNAME uncloaking checks the initial and final domain names but not every intermediate alias in the chain. When a site breaks, you can turn Shields off for that site only, and protection stays on everywhere else. Brave also offers a stricter Aggressive mode, which it says carries a higher risk of breaking sites.
Afolabi also points out the optional crypto features. Shields don't need them, so if you have no use for that side of Brave, you can turn it off.
Cryptomator: encrypt files before they reach OneDrive
If you rely on OneDrive, Google Drive or Dropbox, Cryptomator lets you keep using them while the provider only ever holds encrypted files. It encrypts locally before syncing, including file contents, filenames and folder structure. The desktop app is free on Windows, macOS and Linux, and you can create as many vaults as you like.
Mobile is where the free plan stops. The free Android and iOS apps are read-only, and editing or managing files requires paid access. Cryptomator's July 2026 announcement describes a freemium model on Android with a 30-day full-feature trial. It also says a one-time purchase is permanent, while a subscription drops back to read-only when it ends.
Cryptomator is not a backup tool. It also can't protect files from malware that is already on your PC while the vault is unlocked.
The verdict: start free and pay when you hit a real limit
The MakeUseOf piece makes a reasonable case: a paid plan isn't automatically the more serious option. Its main weakness is that it's one person's setup. The free limits that suit a single user can frustrate a household of five, especially on NextDNS. On Proton VPN, a single connection means your laptop and phone can't both be protected at the same time.
To run your own subscription audit:
- Write down what each paid tool protects: traffic, passwords, email, DNS, browser or files.
- Compare each one with the free-tier limits in the table above.
- Run the free alternative alongside the paid one for one billing cycle before you cancel anything.
- Pay for a specific missing feature, such as integrated TOTP, more VPN connections or unlimited DNS queries, rather than to feel more secure.
Afolabi's rule is to start free and pay only when you can name the problem that money will solve.