Privacy Score Calculator

Scores personal online privacy habits across categories: account hygiene (password manager, 2FA, breach exposure), browser configuration (tracker blocking, cookie controls), network (VPN usage, DNS provider), data minimization (social media footprint, data broker opt-outs), and device security (encryption, automatic updates).

Output is a numeric score from 0–100 with breakdown per category and prioritized recommendations. The scoring weights privacy outcomes, not specific tools; multiple paths to a high score exist.

The scoring framework reflects observed threat models for typical consumers. Account compromise via credential stuffing remains the most common privacy breach, motivating heavy weight on password manager adoption and 2FA. Device theft and loss expose data in plaintext if disk encryption is off, justifying high weight there. Network-level surveillance (ISP tracking, public WiFi snooping) is real but narrower in impact — for most users, an authenticated session to a logged service reveals more than an ISP could observe.

Account hygiene category covers: unique password per account (60% of consumers reuse passwords across accounts, per multiple breach studies), password manager adoption (LastPass, 1Password, Bitwarden), 2FA coverage on critical accounts (email, banking, primary social), breach monitoring (HaveIBeenPwned subscription or equivalent), and recovery method strength (security questions are weak; recovery codes stored offline are stronger).

A worked example: a user with Bitwarden installed (15 points), unique passwords for primary accounts but reused passwords for low-stakes accounts (10 of 15), 2FA on email, banking, and one social account (10 of 15), no breach monitoring (0 of 5). Account hygiene subscore: 35/50. Pair with a browser using uBlock Origin and Privacy Badger (full browser score, 15/15), no VPN (0/10 — flagged but low priority), full-disk encryption enabled, automatic updates on (10/10 device). Total: 35 + 15 + 0 + 10 = 60/100. Recommendations sort by impact: enable 2FA on remaining social account (+5), audit reused passwords (+5), consider HIBP subscription (+5).

VPN scoring deserves particular comment. The marketing positioning of VPN services — "be anonymous online" — overstates the protection actually delivered. VPNs prevent ISP-level traffic visibility on hostile networks (coffee shop WiFi, hotel networks). They do not protect against tracking by services where you are logged in (Google still knows you regardless of any VPN in front of the connection), nor against browser fingerprinting, nor against breach exposure. The score weights VPN modestly because the protection is narrow.

Limitations: scoring discrete categories obscures interactions. A user with weak account hygiene but strong device security can suffer total compromise via a single phishing email; the strong device score does not compensate. The score is a planning prompt, not a security assurance. Real privacy outcomes depend on the threat model; a journalist faces different risks than a consumer using social media. The calculator targets the consumer baseline.