What is anonymity?
Anonymity is not just hiding your name. Learn how identity risk arises from information, behavior, and context.
Course is for learning anonymity as a judgment system, not as isolated techniques.
Learn is for finding specific articles; Course is for building understanding in reading order. It starts from anonymity literacy in the AI surveillance era, then moves through networks, correlation, environment separation, anonymous operation, and practice by situation.
A starting point for learning anonymity as a judgment system that protects people, not as a technique for abuse.
People who first want to understand why anonymity literacy matters now
Anonymity is not just hiding your name. Learn how identity risk arises from information, behavior, and context.
AI makes it easier to connect small pieces of public and behavioral information, making anonymity literacy a basic defense for ordinary people and vulnerable groups.
Learn how to use Check, Learn, and Course together and connect them to pre-publication judgment.
Anonymity protects consultation, whistleblowing, source protection, civic activity, and ordinary people facing unequal risk.
Protecting anonymity in a recorded society means understanding who can see what and reducing unnecessary correlation.
AI and search technologies make it easier to organize posts, images, writing style, translation, and small clues that narrow identity candidates.
Learn why personal information, images, writing style, search results, and past posts become easier to connect in the AI era.
Course is for learning anonymity as a judgment system, not as isolated techniques.
Learn is for finding specific articles; Course is for building understanding in reading order. It starts from anonymity literacy in the AI surveillance era, then moves through networks, correlation, environment separation, anonymous operation, and practice by situation.
Intro
A starting point for learning anonymity as a judgment system that protects people, not as a technique for abuse.
People who first want to understand why anonymity literacy matters now
Anonymity is not just hiding your name. Learn how identity risk arises from information, behavior, and context.
AI makes it easier to connect small pieces of public and behavioral information, making anonymity literacy a basic defense for ordinary people and vulnerable groups.
Learn how to use Check, Learn, and Course together and connect them to pre-publication judgment.
Anonymity protects consultation, whistleblowing, source protection, civic activity, and ordinary people facing unequal risk.
Protecting anonymity in a recorded society means understanding who can see what and reducing unnecessary correlation.
AI and search technologies make it easier to organize posts, images, writing style, translation, and small clues that narrow identity candidates.
Learn why personal information, images, writing style, search results, and past posts become easier to connect in the AI era.
Basics
Learn how PCs and phones connect to websites as background knowledge for understanding anonymity.
People who want to understand communication mechanisms step by step
Learn how internet communication moves through physical infrastructure, signals, wireless links, carrier networks, servers, CDNs, and networks of networks.
Learn how PCs and smartphones communicate with external services through apps, the OS, device network functions, Wi-Fi routers, and base stations.
Wi-Fi, routers, access lines, ISPs, mobile carriers, HTTPS, VPNs, and Tor expose different parts of a communication route.
Learn the client-server relationship behind web communication and what may be visible to destination servers when thinking about anonymity.
Learn how CDNs relate to website delivery, cache, TLS termination, logs, and the source IP address visible to servers.
Understand the TCP/IP model layers and why IP, TCP/UDP, DNS, HTTP, cookies, and User-Agent belong to different parts of communication.
Protocols are communication rules. DNS, HTTP, HTTPS, TCP, UDP, and TLS each protect and expose different parts of communication.
Learn TCP/IP as a protocol suite, including IP, TCP, UDP, DNS, HTTP, TLS, ports, web flow, and anonymity cautions.
An IP address is not a personal name, but it can be an important clue for understanding the source of communication.
Device IP addresses and website-visible IP addresses can differ. Learn private IPv4 ranges, NAT, NAPT/PAT, CGNAT, and why NAT is not anonymization.
Learn how data is split into packets, how routers forward them, and what encryption does not fully hide along the communication path.
Learn how ports, TCP/UDP, source and destination ports, 5-tuples, and sockets route communication to services and applications.
TCP and UDP are chosen by communication purpose, not rank. Learn byte streams, datagrams, QUIC, HTTP/3, DNS, Tor, and anonymity relevance.
DNS maps domain names to IP addresses, and DNS queries can reveal which domains someone tried to view.
Learn the difference between HTTP and HTTPS, what HTTPS protects, and why destinations and access logs do not disappear.
Learn what TLS protects in HTTPS, including confidentiality, integrity, and authentication, and why TLS is not anonymization.
Learn the flow from URL entry through DNS, connection, HTTP/HTTPS communication, and page rendering.
Websites may see source IP, time, URL, User-Agent, cookies, login state, referrer, browser traits, and server-log combinations.
Learn how connection time, source address, destination, URL, DNS, and other logs can remain with operators, providers, and network systems.
Understand IP addresses, DNS, HTTP/HTTPS, browsers, cookies, and logs before judging anonymity from tools alone.
Public Wi-Fi may change the visible outside IP, but operator logs, cookies, login state, cameras, and location records can still remain.
Principles
Understand how anonymity is maintained and how it breaks through correlation, metadata, routes, and browser traits.
People who want to understand VPNs, Tor, fingerprints, and metadata from first principles
Anonymity has changed from letters and pen names to metadata, mass surveillance, and AI-era correlation.
Anonymity reduces correlation through connection paths, browsers, accounts, environments, metadata checks, and trust models.
Anonymity can fail through networks, identifiers, post content, metadata, time, writing style, past information, and operational mistakes.
An IP address is only one clue. Accounts, browser state, metadata, timing, and content can still identify you.
Organize what to protect, from whom, actor capabilities, risk levels, and which services or actors you trust before choosing anonymity measures.
Time, location, topic, style, and technical traces can combine into identification risk even when each clue seems small.
Hiding a network route changes who can see source IP addresses, destinations, timing, and traffic, but cookies, login state, and content remain separate risks.
Compare VPNs, Tor, and proxies by visible information, trusted parties, scope, use cases, limits, DNS leaks, WebRTC, cookies, and logins.
Learn how browser and device characteristics such as screen size, language, fonts, Canvas, WebGL, and extensions become identifying material.
Files can contain metadata such as author, time, location, device, software, and edit history that affects anonymity.
Anonymity depends on situation, adversary, behavior, time, technology, and operation, so it should be treated as risk reduction rather than a guarantee.
Event timing, access logs, VPN or Tor connection times, login history, cloud edit history, file timestamps, drafts, and scheduled posts can connect separate activity.
Place correlation links post content, images, time, movement, and routine-place clues to infer where someone or people involved may be.
Writing style can become correlation material through sentence endings, punctuation, phrasing, topic choices, AI-era comparison, and long-term overlap.
Account correlation can connect anonymous, real-name, and past accounts through usernames, icons, profiles, registration details, follow relationships, and login state.
IP, DNS, cookies, User-Agent, WebRTC, login state, browser state, devices, and operations can combine into identification risk.
Published content can connect with past information, real-name accounts, affiliations, places someone regularly spends time, and memories of people involved.
Cookies, sessionStorage, and localStorage store browser information in different ways and can identify the same browser even when the IP address changes.
A DNS leak can reveal queried domain names through an unintended route even when a VPN or Tor changes other parts of the connection path.
WebRTC can expose browser-side network clues depending on environment, so check IP visibility, browser behavior, VPN scope, and remaining correlation risks.
Compare VPNs, Tor, proxies, anonymity-focused OSes, and environment separation by purpose, trusted parties, visible information, and remaining risks.
Practice
Turn anonymity principles into concrete practice with tools, environment separation, checks, and long-term habits.
People who want to organize Tor, VPNs, local tools, dedicated browsers, and anonymous environments as practice
Services such as Tor, VPNs, browsers, and metadata tools help, but anonymity also depends on how they are used over time.
Organize Tor, VPNs, browsers, anonymous OSes, metadata tools, and sharing tools by what they protect and what remains.
Learn environment separation, account separation, pre-posting checks, and response rules needed before and after using anonymity services.
Offline protection can reduce remote attack surfaces for keys, cameras, and sensitive materials, while physical risks still remain.
Real-name environments retain cookies, login state, cloud sync, file history, device names, autofill, and other traces that can correlate with anonymous activity.
Account separation means separating the real-name side and the anonymous side in identifiers, environments, and behavior, not just creating another account.
Login state can connect activity to real-name accounts even when VPNs, Tor, cookie deletion, or separate browsers change other clues.
Browser separation reduces mixing with real-name cookies, logins, history, passwords, extensions, sync, bookmarks, and localStorage, but other risks remain.
Use Tor Browser without mixing real-name logins, extensions, sync, downloaded files, non-browser app traffic, or ordinary browser habits.
A VPN changes the visible source IP and route visibility, but the VPN provider becomes a trusted party and browser, account, DNS, and content risks remain.
Before, during, and after VPN use, check purpose, IP visibility, DNS leaks, kill switch behavior, browser state, logins, and after-use traces.
Text and speech can weaken anonymity through experience, topic combinations, writing style, voice, dialect, background sounds, replies, and DMs.
Images can reveal locations, routine places, affiliations, devices, capture times, and people involved through metadata and visible clues.
Learn how ExifTool helps check metadata in images, PDFs, videos, Office documents, and similar files locally before publication.
Images can contain EXIF, GPS, device, and editing data. Check and remove metadata before anonymous publication.
URLs can reveal search terms, IDs, session-like data, tracking parameters, sharing routes, permissions, and logged-in service context.
Compare anonymous OSes and separated environments by purpose, difficulty, protected scope, and remaining risks.
Compare anonymous OSes and communication environments by purpose, difficulty, and the risks they can address, not by name alone.
Learn how to avoid fixed posting times and overlap with the real-name side when operating an anonymous account.
Replies and DMs can raise detail granularity, preserve records, spread through screenshots or devices, and make not replying safer in high-risk situations.
Check communication, browsers, accounts, files, post content, time, and past information together before anonymous activity.
Persona separation means separating accounts, registration details, browsers, topics, writing style, time, images, contacts, and long-term behavior.
Email addresses, phone numbers, recovery accounts, two-factor authentication, and contact syncing can connect anonymous accounts with real-name environments.
Personal clouds, shared links, edit history, owners, and workplace or school cloud logs can reveal a file source or creation environment.
Check the information that tends to remain in each file format and the points to review before publication.
Check original files, filenames, metadata, contents, sharing routes, and recipient-side display before anonymous file transfer.
Submissions and shared files can reveal sources through metadata, filenames, author information, channel clues, and post-submission handling.
Learn the approach of reducing over-specialization and separating environments rather than trying to erase browser fingerprints completely.
Mixnets and NymVPN relate to communication-volume and timing correlation, but they do not replace operational separation.
Practice
Understand how public information can narrow identity and how to reduce exposure from search results and old traces.
People who want to reduce identification risk from search results and past information
OSINT means Open Source Intelligence: checking public information defensively to understand exposure, correlation, limits, and false links.
OSINT can connect anonymous activity to past public information through usernames, images, writing style, archives, and search results.
Search for names, handles, email addresses, usernames, affiliations, and images to understand what past information is visible from outside.
Past posts, profiles, handles, replies, images, friendships, and search results can connect to current anonymous activity.
Image search, face images, and icons can connect anonymous activity to past accounts, real-name information, routine places, and people nearby.
Archives can retain deleted blogs, old profiles, handles, images, and event pages that may connect with current anonymous activity.
Data brokers, directories, and public data can help expose personal information and narrow candidates when combined with anonymous posts.
Public posts can reveal routine places through stations, weather, shops, commute times, school events, photo backgrounds, and past social media.
Separate original pages, search results, archives, and republished copies when reducing personal information visible through search.
Inventory past information, prioritize risks, edit what you control, request removal, check archives, and adjust future posting rules.
Regularly check what is externally visible about your name, old handles, social media IDs, email addresses, profiles, images, and archives.
Practice
Learn common operational mistakes before practice so long-term anonymity does not collapse through small correlations.
People who want to know typical failure patterns before putting anonymity practices into use
Learn common ways anonymity breaks down through small correlations, tool limits, operational habits, and post-failure cause analysis.
A single real-name login, reused image, workplace clue, screenshot notification, or posting-time overlap can reframe an entire anonymous history.
Writing style, topics, personal experiences, time, images, accounts, and environment can combine into identification risk even when text is rephrased.
Posting time can correlate with life rhythms, real-name accounts, on-site activity, scheduled-posting logs, replies, and long-term monthly patterns.
Reused usernames, similar names, icons, image style, search results, screenshots, archives, and relationship networks can connect anonymous accounts to past information.
Searching for anonymous activity from real-name accounts or browsers can leave search terms, login state, history, sync, and click traces on the real-name side.
Real-name email, cloud sync, contacts, work files, past images, and saved passwords can connect anonymous and real-name environments.
Screenshots and screen sharing can expose edges, notifications, browser chrome, metadata, recipient-side saving, audio, camera, and post-publication risks.
Replies, DMs, and added evidence after publication can reveal region, timing, workplace, people involved, and other clues that narrow identity candidates.
When you notice risk after publication, organize deletion, correction, avoiding additional posts, and seeking advice.
By purpose
A practical route for reducing exposure around social media, search results, photos, family information, and children’s photos.
Individuals who want to reduce exposure for themselves or their family
Ordinary people can reduce unnecessary identification paths from posts, photos, routine places, old handles, family information, and cloud sharing.
Social media posts can be found through search results, screenshots, reposts, archives, and image search, connecting anonymous and past accounts.
Check how children's face photos and life information can lead to misuse, impersonation, deepfakes, and future disadvantage.
Face photos, voices, backgrounds, and routine places can be misused for impersonation, harassment, and AI-generated abuse.
Anonymous posts can expose family, friends, colleagues, and children through faces, names, screenshots, tags, and usual-place clues.
Review old posts to reduce links to current anonymous activity by checking identifiers, handles, images, routine places, surrounding people, and public exposure.
Search defensively for names, old handles, profile text, affiliations, images, snippets, URLs, and old pages while accounting for search logs.
Check faces, backgrounds, reflections, location information, metadata, and captions before publishing photos.
Cloud sharing links can expose owners, accounts, permissions, previews, access logs, notifications, and recipient-side real-name login traces.
Convenient file sending can expose sender accounts, owner names, sharing history, notifications, viewing logs, filenames, metadata, and recipient-side handling.
Before everyday posts, check names, faces, addresses, family, friends, photos, videos, past posts, file sharing, and publication scope.
By purpose
Covers source protection, file metadata, communication traces, and inference risks from published reporting.
People who need to publish while protecting sources and related people
Journalist anonymity focuses on who may be suspected of providing information, including sources, witnesses, materials, contact paths, and article details.
Before contact, define who to protect from, what to protect, leak paths, risk levels, article edits, and precautions to explain to sources.
SecureDrop is source-protection infrastructure for anonymous tips using Tor Browser and receiving-side operations, but remaining risks still need management.
OnionShare is a Tor-based option for temporary sharing and receiving, but file contents, metadata, address delivery, and recipient handling still matter.
Compare SecureDrop, GlobaLeaks, and OnionShare by purpose, receiving-side operation, and remaining risks.
Contact with sources leaves traces in email, DMs, calls, cloud links, video meetings, first contact, and post-publication investigations.
Files from sources can contain metadata, edit history, comments, filenames, visible clues, and audio clues. Check before sharing or publishing.
Before publishing media, check faces, backgrounds, reflections, voices, metadata, editing output, and source protection risks.
Published stories can reveal sources through timelines, departments, meetings, quotations, photo angles, material types, specificity, timing, and later additions.
Separate contact with sources from personal accounts, devices, clouds, notifications, and storage to reduce traces around sources.
Publication timing, reporting locations, photo backgrounds, capture angles, and material version details can narrow possible sources.
Before publishing, journalists should check sources, contact paths, materials, article text, publication timing, and check records for source protection risks.
By purpose
Handle documents, PDFs, Office files, cloud history, edit history, and recipient choice with extra care.
People considering high-risk publication involving internal documents or organizational information
Whistleblower anonymity requires thinking beyond communication routes, including internal logs, document sources, safety, legal risk, consultation, tools, and publication scope.
Whistleblowing threat models organize who may identify the source, what to protect, leak paths, risk level, and next countermeasures.
Learn how GlobaLeaks fits into organizational reporting-channel design, including cautions for whistleblowers and operators.
Before using submission tools, check the destination, material, environment, minimum necessary information, and behavior after sending.
Document files can retain author names, organization names, templates, comments, revision history, and internal links.
Office files and PDFs can reveal authors, edit history, hidden elements, redaction problems, source flow, and people involved.
For whistleblowing, cloud history can reveal who created, opened, copied, shared, downloaded, commented on, or changed materials.
Paper, scans, and photos can still reveal print logs, scanner details, photo backgrounds, metadata, watermarks, distribution scope, and source clues.
Whistleblowing content can narrow the source through departments, meetings, materials, timelines, systems, evidence files, and writing style.
Review the trust model, submission path, identity verification requests, and the option not to force publication.
Before publishing or submitting whistleblowing material, check the threat model, files, cloud history, devices, destination, and post-publication behavior.
By purpose
Covers event participation, posting times, contacts, social accounts, location data, harassment, and tracking risks.
People in civic activity who want to reduce exposure of identity, peers, and places
Activist anonymity protects allies, participants, supporters, venues, travel routes, and contact networks, not only the speaker.
Event names, locations, photos, and posting times can reveal participation, movement, roles, and allies in activist activity.
Photos and videos can reveal participants, venues, travel routes, surrounding facilities, reflections, audio, and posting times.
Group chats and contact syncing can reveal participants, roles, phone numbers, message history, shared files, invite links, and activity structure.
Check file contents, filenames, metadata, cloud owner information, sharing paths, recipients, and link lifetime before anonymous file sharing.
Activist social media should be operated separately from personal social media, including accounts, browsers, materials, content, permissions, and daily rules.
Activity posts can reveal gathering places, routes, venues, allies, and routine places through location information and posting time.
Activist accounts can still correlate through shared devices, browsers, cookies, notifications, sync, history, and network environments.
For activist posts, risk can grow after publication through replies, DMs, backlash, harassment, screenshots, and old-post digging.
Check people, places, times, social media accounts, files, links, and post-publication response before activist communication goes out.