Kit & Key
How we choose tools
Disclosure: Kit & Key is an independent privacy-stack site. Some links on kit pages are affiliate links. If you buy through them, we may earn a commission. That does not change the price you pay. Bitwarden, Mullvad, and Tuta are unpaid controls. We do not earn anything when we point you there.
This page is the rulebook. The kits follow it. About Kit & Key is who we are.
The install order is fixed
Password manager first. Antivirus second. VPN last. That order is not a ranking. It is the order you install.
- Password manager. Every other account gets a unique password, including the VPN. You do this first so you are not typing a reused password into the next two tools.
- Antivirus. It covers the machine before you start tunneling. A VPN does not scan the file you just downloaded.
- VPN last. Finish account setup on a network you already trust. Then the tunnel is the last layer you turn on.
The freelancer kit inserts encrypted email before antivirus: password manager, encrypted email, antivirus, VPN. Invoices live in the mailbox. The mailbox account belongs in the manager first. Then the device layers.
We do not rearrange this to put a commercial pick on top.
What we optimize for
- Setup time. About ten minutes at home, not a weekend project.
- Clarity. One default pick. One or two forks if your situation is different. Not a grid of twenty logos.
- Device limits. A household plan that runs out at phone number four is the wrong plan for a household.
- Honest free tiers. If the free product is scan-only, we say scan-only.
- Exit options. Unpaid controls stay named so you can leave the commercial pick.
What we do not do
- Paid rankings. Nobody buys a slot on a numbered list here. There is no numbered list.
- Fake speed tests. We do not invent lab numbers. We do not paste a competitor’s benchmark and call it ours.
- Anonymity theater. A VPN hides traffic from the network you do not control. It does not make you anonymous. We will not sell that story.
We also do not write for journalists under targeted attack. That belongs on About.
How affiliate relationships affect which paid tools appear
We can recommend paid tools we have, or can get, a program for. That is the commercial set.
Unpaid controls are named anyway. Bitwarden, Mullvad, and Tuta have no consumer program we use. They stay on the kits as the privacy-maximalist fork.
Commission does not change the price you pay. It does change which paid tools we can recommend with a straight face. If we cannot get a program, that paid product is less likely to be the default pick. It may still appear as context. The unpaid control is the other door.
This is not a secret. Kit pages say it in the disclosure at the top.
Default commercial picks, today
These are situation picks, not a ranking of 47 tests.
- Password manager: 1Password, or Proton Pass if you already want Proton.
- Antivirus: Malwarebytes.
- VPN: Proton VPN as the usual paid pick. Surfshark when device slots are the problem (family). NordVPN as the other paid VPN if you want that app instead of Proton.
Forks on the kits are situational. Unlimited devices vs named accounts. Individual vs Families. They are not a scoreboard.
Unpaid controls sit next to those picks: Bitwarden, Mullvad, Tuta.
If a default changes, this page should change with it. The kits keep the same install order.