E2EE Messaging
CISA strongly recommends Signal for all communications.
Mobile Hardening Guide
Ensure the safety and security of your mobile devices with guidelines tailored for Android and iOS.
Official Security Guidance
Section titled “Official Security Guidance”Authoritative recommendations from government agencies.
NSA Best Practices Essential one-page infographic.
CISA Mobile Guidance Latest 2025 best practices.
NIST SP 800-124 Enterprise management guidelines.
CIS Benchmarks Technical configuration details.
Critical Recommendations (2024-2025)
Section titled “Critical Recommendations (2024-2025)”Kill the SMS 2FA
Do NOT use SMS for MFA. SIM-swapping increased by 1,055% in some regions in 2024.
Personal VPNs
CISA advises against commercial VPNs for personal use as they often simply shift risk to the VPN provider.
Modern Hardware
Use the latest hardware; software updates alone cannot provide hardware-level security features.
Platform-Specific Hardening
Section titled “Platform-Specific Hardening”Critical iOS Settings
Section titled “Critical iOS Settings”- Enable Lockdown Mode: Settings → Privacy & Security → Lockdown Mode. (For high-risk targets).
- Stolen Device Protection: Settings → Face ID & Passcode → Enable.
- USB Accessories: Settings → Face ID & Passcode → Require Unlock.
- Significant Locations: Disable in Privacy → Location Services → System Services.
App Management
Section titled “App Management”- Only install from the Official App Store.
- Review Tracking Permissions regularly.
Hardened Android OS
Section titled “Hardened Android OS”For maximum security, consider a hardened ROM:
- GrapheneOS: The gold standard for security (Pixel only). See grapheneos.org for upstream docs.
- CalyxOS: Privacy-focused with broader support.
Stock Android Settings
Section titled “Stock Android Settings”- Google Play Protect: Enable in Play Store → Profile.
- Find My Device: Enable in Settings → Security.
- Unknown Sources: Keep disabled in Security settings.
- Developer Options: Keep disabled unless actively debugging.
F-Droid Store
Section titled “F-Droid Store”Use F-Droid for privacy-respecting, open-source apps. See the Open-Source Android Apps section below for a curated day-one list.
App Isolation on Android
Section titled “App Isolation on Android”Android lets you run untrusted or invasive apps inside an isolated container — a separate work profile or Private Space — so they can’t see your contacts, photos, location history, accounts, or notifications from your main profile. This is the single most effective mitigation for “the app I need is greedy with permissions” (banking apps that demand location, social media apps that scrape contacts, game launchers, MDM-style work apps, etc.).
Private Space (Android 15+)
Section titled “Private Space (Android 15+)”The modern, recommended path. Native to AOSP, no third-party admin app required. Settings → Security & privacy → Private space.
- What it gives you: separate, encrypted container with its own apps and accounts. Hides from the launcher when locked. Integrates with notifications and search while unlocked.
- Setup: lock with a separate PIN/biometric. Sign into a different Google account (or none) for an isolated Play Store.
- Footguns:
- Discoverable via system search on Pixel — type “Private” in the system search bar and it appears. Not a true panic-room. Disable the “show in search” toggle if you care.
- No SMS or phone access inside Private Space. Breaks any flow that needs SMS verification for an isolated account.
- Only one Private Space per device. For more compartments, use full secondary user profiles.
- Requires Android 15 and ≥6 GB RAM — most modern Pixels qualify; many budget devices don’t.
Shelter (Android 14 and earlier)
Section titled “Shelter (Android 14 and earlier)”Shelter (GPLv3, on F-Droid) is the recommended pick if your device doesn’t have Private Space. It uses Android’s stock work-profile API to create a second container — no ADB or root required, normal app install.
- What it gives you: clone or freeze any installed app; run two copies of the same app (e.g., two WhatsApp accounts); block cross-profile contact search (the feature Insular and Island lack).
- Trust caveat: Shelter requires Device Admin rights inside the work profile. The Shelter app has full control over everything in that profile. Vet the developer (PeterCxy) and stick with F-Droid releases.
- Maintenance status: the maintainer has explicitly placed Shelter in feature-frozen mode but continues to ship Android-compat updates (targetSdkVersion 35 confirmed Oct 2024). It is not abandoned — treat it as legacy-but-supported.
Samsung Secure Folder
Section titled “Samsung Secure Folder”If you’re on Samsung One UI, Secure Folder is generally a better fit than any third-party app — deeper integration, Knox-backed, and Samsung typically restricts personal work-profile creation anyway. Trade-off: it’s Samsung-proprietary and tied to a Samsung account.
Apps we no longer recommend
Section titled “Apps we no longer recommend”- Insular — FOSS fork of Island. Maintenance has slowed (last meaningful commit July 2025) and it lacks Shelter’s cross-profile contact-search blocking. Acceptable but not preferred.
- Island — the original by Oasis Feng. Last public commit September 2021; mobile module is closed-source; carries Google-services dependencies. Skip.
Complementary tool: App Manager
Section titled “Complementary tool: App Manager”App Manager (GPLv3+, very active — commits as of June 2026) is not an isolation container — it does not create work profiles or clone apps. It complements Private Space / Shelter by giving you per-app freeze, component blocking, tracker scanning, permission revocation, and net-policy control. Pair it; don’t substitute it.
Privacy Guides — Android Apps Current Shelter / Private Space recommendation.
GrapheneOS Forum — Profiles vs Workspaces Official position on Shelter-style apps.
Side of Burritos — Private Space Migration walkthrough.
AOSP — Private Space Technical reference.
Open-Source Android Apps (Day-One Picks)
Section titled “Open-Source Android Apps (Day-One Picks)”A curated list of privacy-respecting Android apps worth installing before you sign into Aurora Store or sandboxed Google Play. Most are on F-Droid main (the safest, reproducibly-built channel); a few honest exceptions noted per app. Treat this as a starter pack — none of these are mandatory.
App sources (install first)
Section titled “App sources (install first)”| App | What it does | Install from |
|---|---|---|
| Aurora Store | Anonymous (or signed-in) proxy to Google Play Store | F-Droid main: com.aurora.store |
| Obtainium | Keeps apps current by polling upstream GitHub/GitLab releases — faster than F-Droid’s build queue | IzzyOnDroid: dev.imranr.obtainium.app |
Secure messaging
Section titled “Secure messaging”| App | What it does | Install from |
|---|---|---|
| SimpleX | Decentralized messenger with no user identifiers (no phone number, no email, no account). Strongest metadata-resistance of mainstream FOSS messengers. | F-Droid main: chat.simplex.app |
| App | What it does | Install from |
|---|---|---|
| Mullvad | Pay-by-cash, no-account, no-logs commercial VPN. Fully open-source client. | F-Droid main: net.mullvad.mullvadvpn |
| Proton VPN | Free tier + paid; integrates with the Proton account suite | IzzyOnDroid F-Droid repo: ch.protonvpn.android, or direct APK from protonvpn.com. Not on F-Droid main — has optional Google Play Services hooks (disableable). |
Password manager
Section titled “Password manager”| App | What it does | Install from |
|---|---|---|
| KeePassDX | Offline, fully local password vault using the KeePass KDBX format. No accounts, no cloud, no servers to trust. Now supports passkeys. GPLv3. | F-Droid main: com.kunzisoft.keepass.libre (the “libre” build — FOSS, no Google libs) |
| Proton Pass | Cloud-synced password manager + passkeys + email-alias support; ties into Proton account suite. Open-source client. | IzzyOnDroid F-Droid repo: proton.android.pass, or direct APK from Proton. Not on F-Droid main. |
Pick one based on whether you want offline-only (KeePassDX) or synced across devices (Proton Pass, or Bitwarden listed in the Recommended Apps section below).
| App | What it does | Install from |
|---|---|---|
| Thunderbird for Android | Mozilla’s mobile email client — the rebranded successor to K-9 Mail (rebrand completed late 2024, shares the same codebase). | F-Droid main: net.thunderbird.android. Don’t install both Thunderbird and the legacy com.fsck.k9 listing — same upstream, will confuse you. |
Browser
Section titled “Browser”| App | What it does | Install from |
|---|---|---|
| DuckDuckGo Privacy Browser | Privacy-respecting browser with built-in tracker blocking and Email Protection. Apache-2.0 client. | F-Droid main: com.duckduckgo.mobile.android. Note F-Droid’s NonFreeNet tag — the DDG search backend is proprietary (the client is FOSS). |
File encryption & sync
Section titled “File encryption & sync”| App | What it does | Install from |
|---|---|---|
| Cryptomator | Per-file encryption for cloud storage. Mount-as-folder UX. | F-Droid main: org.cryptomator |
| Syncthing-Fork | Actively-maintained successor to the discontinued upstream Syncthing-Android. P2P, no cloud, no account. | F-Droid main: dev.catfriend1.syncthingandroid. Use this fork — the original com.nutomic.syncthingandroid was discontinued in late 2023. |
AI assistant (optional)
Section titled “AI assistant (optional)”| App | What it does | Install from |
|---|---|---|
| Lumo by Proton | Privacy-focused AI assistant from Proton (launched July 2025) | Play Store only (me.proton.android.lumo) — not on F-Droid, no direct APK. On a fully de-Googled phone, use the web app at lumo.proton.me as the FOSS-friendly fallback. |
Avoid: apps you may see recommended elsewhere
Section titled “Avoid: apps you may see recommended elsewhere”- Haven (Guardian Project,
org.havenapp.main) — was a phone-as-motion/sound-detector anti-surveillance app, famously co-launched by Edward Snowden in 2017. Last release was July 2020, delisted from F-Droid main, Signal integration broken per the maintainers’ own notes, no successor announced. Don’t install. For adjacent use cases see Guardian Project’s other still-maintained apps (Orbot, ProofMode).
OpenPGP / GPG Apps (Android + iOS)
Section titled “OpenPGP / GPG Apps (Android + iOS)”Mobile OpenPGP covers two distinct use cases — pick the apps to install based on which you actually need:
- Software-key PGP — keys live in the app’s encrypted vault or in the OS keychain. Sign/encrypt mail, decrypt files received from PGP-using correspondents, verify signatures. Works on both Android and iOS.
- Hardware-key (smartcard) PGP — keys live on a YubiKey or Nitrokey; the phone signs/decrypts by talking to the card over USB-C or NFC. Android only in 2026 — iOS has no app that drives the OpenPGP applet.
Android — open source (F-Droid main)
Section titled “Android — open source (F-Droid main)”| App | Package | Status | Notes |
|---|---|---|---|
| OpenKeychain | org.sufficientlysecure.keychain | ⚠️ Maintenance mode (announced Aug 2021, v6.0.4 Mar 2024) | Still the de-facto Android OpenPGP backend. Drives YubiKey + Nitrokey over USB-C OTG cable and NFC. No replacement exists. |
| Thunderbird for Android | net.thunderbird.android | ✅ Active (MZLA / Thunderbird team) | Integrates with OpenKeychain for sign/encrypt mail. K-9 → Thunderbird rebrand completed late 2024. Don’t run both. |
| K-9 Mail (legacy) | com.fsck.k9 | ✅ Same binary as Thunderbird for Android | Channel kept alive during the transition. Pick one. |
| FairEmail | eu.faircode.email | ✅ Active | Alternative PGP-aware mail client. OpenKeychain integration. Free core; some Pro features paid. Also on F-Droid main as of recent. |
| Termux + GnuPG | com.termux | ✅ Active — F-Droid only (Play Store version was abandoned 2020) | Power-user path. pkg install gnupg gives you full desktop-grade GPG. The okc-agent bridge to OpenKeychain is reported broken on GrapheneOS — treat as fragile. |
Android — market (Play Store)
Section titled “Android — market (Play Store)”Most of the F-Droid apps above (OpenKeychain, Thunderbird for Android, FairEmail, K-9) also ship on the Play Store at the same package IDs. Pick the channel that fits your update flow.
Don’t use the Play Store Termux build — it was abandoned in 2020 and won’t start on modern Android. F-Droid is the only supported channel.
iOS — App Store
Section titled “iOS — App Store”No F-Droid on iOS. All iOS PGP apps are App Store only.
| App | Status | Cost | Notes |
|---|---|---|---|
| iPGMail | ✅ Active (v2026.22.x, May 2026) | $3.99 one-time | The pick for general-purpose iOS PGP. RFC 9580 v6 keys, X25519/Ed25519, AEAD. Imports/exports .asc. Keys stored in iOS Keychain, Face/Touch ID gated. Share-sheet workflow since iOS forbids Mail.app plugins. |
| Canary Mail | ✅ Active | Pro+ ~$100/yr | OpenPGP-aware mail client (not a general PGP utility). Interops via SKS / Keybase / openpgp.org / Proton keyservers. Use only if you want PGP baked into your mail client and accept the subscription. |
| Proton Mail | ✅ Active | Free + paid tiers | Native OpenPGP; interops with external PGP users via WKD since 2018. Keys live in your Proton account (not iOS Keychain). Still no hardware-key support in 2026. |
- PGPro (iOS) — Removed from the App Store January 2025, last update Nov 2021. Older privacy guides still link to it. Don’t install. Use iPGMail instead.
- APG (Android) — Original OpenKeychain ancestor; long dead.
- Termux from the Play Store — Abandoned 2020. Use the F-Droid version.
Hardware-key (smartcard) PGP — quick reference
Section titled “Hardware-key (smartcard) PGP — quick reference”| Platform | Smartcard support | How |
|---|---|---|
| Android | ✅ | OpenKeychain over USB-C OTG cable or NFC tap. Pair with Thunderbird-for-Android / FairEmail / K-9 for mail. |
| iOS | ❌ | No iOS app drives the OpenPGP applet on YubiKey 5Ci or USB-C iPhone. Hardware-smartcard PGP from a phone = Android. |
See also
Section titled “See also”- Email Hardening Guide → PGP-Capable Email Clients — full desktop + mobile client compatibility table
- SSH & GPG Keys → GPG (OpenPGP) Keys — key generation, subkey strategy, GPG-on-card walkthrough
- GrapheneOS → Hardware Security Keys — what a YubiKey can do on GrapheneOS specifically
Universal Security Checklist
Section titled “Universal Security Checklist”- Strong PIN: Use 6+ digits (avoid birthdates/sequences).
- Weekly Reboot: NSA recommends restarting at least once per week.
- Auto-Lock: Set to 5 minutes or less.
- SIM PIN: Prevent your SIM from being used in another device.
- App Minimalist: Delete unused apps and minimize permissions.
Recommended Apps
Section titled “Recommended Apps”Passwords
Authentication
Messaging
Privacy
Maps
Comaps — privacy-friendly, offline-capable map alternative.