Good security is less about installing lots of utilities and more about keeping software updated, protecting accounts with unique passwords or passkeys, using two-step verification and maintaining reliable backups. The mostly free tools below can help you check for breached accounts, recognise scams, protect your devices, manage passwords, back up important files and carry out basic maintenance. Always download software from its official website and avoid running two real-time antivirus products at the same time.
Last Updated September 2026.
Jump to:
Quick Picks
| I want to… | Quick pick |
|---|---|
| Check whether my email has appeared in a data breach | Have I Been Pwned |
| Check whether a password has appeared in known breaches | Have I Been Pwned: Pwned Passwords |
| Estimate the strength of a password safely | Bitwarden Password Strength Tester |
| Store and synchronise passwords across devices | Bitwarden |
| Keep an offline password database | KeePass |
| Learn to recognise common scams | ScamSpotter |
| Check a UK organisation’s basic online security | NCSC Check Your Cyber Security |
| Inspect the tracking technologies used by a website | Blacklight |
| Check a suspicious link or non-confidential file | VirusTotal |
| Protect a Windows computer from malware | Windows Security |
| Add two-step verification to online accounts | 2FAS Auth |
| Back up a Windows computer | Windows Backup and File History |
| Back up a Mac | Time Machine |
| Create a complete Windows system image | EaseUS Todo Backup or Macrium Reflect X |
| Safely free space on Windows | Storage Sense |
| Defragment selected files on a traditional hard disk | WinContig |
Online Checks and Scam Awareness
Bitwarden Password Strength Tester
Bitwarden’s Password Strength Tester estimates how resistant a password may be to automated cracking attempts. It considers factors such as length, predictability and commonly used patterns and displays an estimated time to crack. The password is processed locally in the web browser rather than being sent to Bitwarden’s servers.
Best for: Estimating the strength of a proposed password or passphrase
Cost: Free
Works on: Web browsers
Worth knowing: The result is only an estimate and does not reveal whether the password has been reused or exposed in a data breach. Avoid testing a password that you already use unless the provider clearly confirms that it is processed locally.
Visit Bitwarden Password Strength Tester
Have I Been Pwned?
Have I Been Pwned allows you to check whether an email address has appeared in known data breaches. Its separate Pwned Passwords tool can check whether a password has appeared in leaked data without sending the complete password to the service. You can also register an email address for free notifications about future breaches.
Best for: Checking whether an email address or password has appeared in a known breach
Cost: Free for individual checks and notifications; paid professional services are available
Works on: Web browsers and email
Worth knowing: A result records historical exposure and does not necessarily mean that someone currently controls the account. Change the affected password anywhere it was reused and enable two-step verification.
ScamSpotter
ScamSpotter is an educational resource from FightCybercrime and Google. It explains common scam techniques and encourages people to slow down, check unexpected requests and avoid sending money or personal information under pressure. Its examples cover several types of telephone, email, text-message and online fraud.
Best for: Learning how to recognise common scam techniques
Cost: Free
Works on: Web browsers
Worth knowing: ScamSpotter provides general education rather than checking whether a particular message, caller or website is genuine. UK users should report suspicious activity through the appropriate UK reporting service. Suspicious emails can be forwarded to report@phishing.gov.uk and suspicious text messages to 7726. If you have lost money through fraud in Scotland, contact your bank immediately and report it to Police Scotland by calling 101.
Visit the UK ScamSpotter website
Guerrilla Mail
Guerrilla Mail provides temporary email addresses without requiring registration. Messages sent to the temporary mailbox remain available for one hour, helping you avoid giving your normal address to a website that only needs to send a one-off download or confirmation.
Best for: Receiving a non-sensitive, one-off email without disclosing your usual address
Cost: Free
Works on: Web browsers
Worth knowing: Anyone who knows the mailbox identifier may be able to view its messages. Never use a temporary address for banking, shopping, confidential information, account recovery or anything you may need to access later.
Blacklight
Blacklight is The Markup’s website privacy inspector. Enter a web address and it simulates a visit, looking for advertising trackers, third-party cookies, session-recording scripts, keylogging behaviour and tracking pixels from services including Meta, Google, TikTok and X.
Best for: Investigating how a website may track its visitors
Cost: Free
Works on: Web browsers
Worth knowing: Results can differ according to location, device and cookie choices. Finding trackers does not automatically prove that a website is malicious or breaking privacy law.
NCSC Check Your Cyber Security
Check Your Cyber Security is a free UK government service that checks an organisation’s publicly accessible website, IP address, email security and web browser for common vulnerabilities. It is designed to be understandable by small businesses, charities, schools and sole traders without specialist technical knowledge.
Best for: Checking the basic external security of a UK organisation
Cost: Free
Works on: Web browsers
Worth knowing: The checks are remote and do not require software installation. It is a useful starting point rather than a complete security audit or penetration test.
Visit NCSC Check Your Cyber Security
VirusTotal
VirusTotal checks files, web addresses and file hashes using results from numerous antivirus engines and security services. It can provide a useful second opinion when a download or link seems suspicious.
Best for: Checking a suspicious link or non-confidential file with several security engines
Cost: Free public service; paid professional and private services are available
Works on: Web browsers
Worth knowing: Files and addresses submitted through the standard public service may be shared with security partners and premium customers. Never upload confidential, personal, client or commercially sensitive files.
hCaptcha
hCaptcha helps protect websites and online services from bots, spam and other automated abuse. It can be added to contact forms, login pages, registration forms and online checkouts, either through a website integration or a compatible plugin. It provides a privacy-focused alternative to Google reCAPTCHA.
Best for: Protecting website forms, logins and registrations from automated spam and bots
Cost: Free Basic plan; paid Pro and Enterprise plans available
Works on: Websites and web applications, including WordPress through compatible plugins
Worth knowing: CAPTCHA challenges can sometimes inconvenience genuine visitors or create accessibility difficulties. hCaptcha provides accessibility alternatives, but you should still test the complete form using a keyboard and assistive technology. It reduces automated abuse but does not replace normal website security, updates or spam filtering.
Password Managers, Generators and 2-Step Verification
Bitwarden
Bitwarden is an open-source password manager that generates, stores and automatically fills passwords and passkeys. Its free personal plan includes unlimited passwords and access across unlimited devices, with browser extensions, desktop applications, mobile apps and a web vault.
Best for: Managing and synchronising passwords across different devices
Cost: Free plan; optional Premium, Families and business plans
Works on: Web browsers, Windows, macOS, Linux, iOS and Android
Worth knowing: Protect the vault with a strong, unique master password and two-step verification. The free plan includes the essential password-management features, while advanced reports, emergency access and some authenticator features require Premium.
KeePass
KeePass stores passwords in an encrypted database that remains under your control. The official program is designed principally for Windows and can run portably from a USB drive. Compatible applications and ports are available for other systems, although these are not all developed by the main KeePass project.
Best for: Keeping an offline or locally controlled password database
Cost: Free and open source
Works on: Windows; compatible ports are available for macOS, Linux, iOS and Android
Worth knowing: KeePass does not automatically provide the seamless cloud synchronisation of services such as Bitwarden. You are responsible for backing up the encrypted database and ensuring that you can still access it if a device fails.
LastPass Password Generator
The LastPass Password Generator creates random passwords using the length and character options that you choose. It can generate passwords that are easier to read or say, or more complex passwords containing uppercase and lowercase letters, numbers and symbols.
Best for: Generating a password with particular character requirements
Cost: Free
Works on: Web browsers
Worth knowing: The online generator creates the password but does not automatically store it. Save the result directly in a trusted password manager rather than emailing it or keeping it in an unprotected document.
Visit LastPass Password Generator
2FAS Auth
2FAS Auth is a free, open-source authenticator application that generates the temporary codes used by accounts protected with two-step verification. It works offline and supports encrypted backups and a browser extension that communicates with the mobile app.
Best for: Adding app-based two-step verification to online accounts
Cost: Free and open source
Works on: iOS, Android and supported browser extensions
Worth knowing: Set up its encrypted backup and retain the recovery codes supplied by each online service. Losing both the phone and the recovery information can make it difficult to regain access to protected accounts.
Passwords Generator
Passwords Generator creates random passwords according to options such as length, capital letters, lowercase letters, numbers, symbols and duplicate characters.
Best for: Creating a password for a website with very specific character rules
Cost: Free
Works on: Web browsers
Worth knowing: It generates passwords but does not provide a secure vault or synchronisation. Bitwarden or LastPass may be more reassuring recommendations because their security and local-processing information is easier to verify.
Malware Protection
Windows Security
Windows Security is built into Windows and includes Microsoft Defender Antivirus, Windows Firewall, SmartScreen and other protection features. It provides real-time malware scanning, checks downloads and can run quick, full, customised and offline scans.
Best for: Everyday antivirus and security protection on a Windows computer
Cost: Included with Windows
Works on: Windows 10 and 11
Worth knowing: Windows 10 reached the end of normal support in October 2025. Installing another real-time antivirus product may disable Microsoft Defender Antivirus, so check what is already protecting the computer before adding anything else.
IObit Malware Fighter
IObit Malware Fighter scans Windows computers for viruses, spyware, adware, ransomware, Trojans and other potentially harmful software. It includes several scanning modes and browser-protection tools. The paid Pro version adds the Bitdefender scanning engine and additional real-time security features.
Best for: Additional malware scanning and browser-protection tools on Windows
Cost: Free version; paid Pro edition available
Works on: Windows 8, 10 and 11
Worth knowing: Windows already includes Microsoft Defender Antivirus. Check which product is providing real-time protection and avoid running two full real-time antivirus products simultaneously, as this can cause conflicts or reduce performance.
Backup and Recovery Tools
Windows Backup and File History
Windows Backup can synchronise selected folders, settings, credentials and an app list through a personal Microsoft account and OneDrive. File History provides a separate way to save versions of personal files to an external drive or network location.
Best for: Backing up Windows folders, settings and previous versions of files
Cost: Included with Windows; additional OneDrive storage or an external drive may cost extra
Works on: Windows 11; also present in Windows 10, which is now out of normal support
Worth knowing: Windows Backup relies on a personal Microsoft account and its free OneDrive allowance is 5 GB. It is not a complete disk-image backup. File History requires an external drive or network location.
Visit Windows backup and recovery help
Time Machine
Time Machine is Apple’s built-in backup system for macOS. It automatically backs up files, apps, photographs, emails and documents to an external drive or supported network destination and allows individual files or an entire Mac to be restored.
Best for: Automatic, versioned backups of a Mac
Cost: Included with macOS; a suitable external or network drive is required
Works on: macOS
Worth knowing: Apple recommends a backup drive with at least twice the storage capacity of the Mac. Keep the backup disk separate from the computer when practical and enable encryption if it contains sensitive information.
EaseUS Todo Backup Free
EaseUS Todo Backup Free can create backups of individual files, folders, Windows partitions, disks or an entire computer. Backups can be scheduled and stored on local drives, external drives, network locations or supported cloud services.
Best for: Creating scheduled file or system-image backups on a Windows computer
Cost: Free for personal use on one computer; paid Home and business editions available
Works on: Windows
Worth knowing: The free edition covers essential backup and recovery tasks, while some advanced cloning, notification and management features require a paid version. A backup is only dependable if you occasionally check it and know how to restore from it.
Macrium Reflect X
Macrium Reflect X creates complete disk images as well as backups of selected files and folders. It can also produce bootable rescue media, allowing a computer to be restored when Windows will not start. It is the replacement for the now-unsupported Reflect 8.
Best for: Full Windows system images, disk cloning and disaster recovery
Cost: Paid annual plan; 30-day free trial available
Works on: Windows
Worth knowing: Macrium Reflect Free is no longer available and Reflect 8 no longer receives support or security updates. Backup software can help you recover after malware or ransomware, but it does not replace antivirus protection. Create and test the rescue media before an emergency.
Maintenance Tools
Storage Sense
Storage Sense is built into Windows and can automatically remove temporary files and older items from the Recycle Bin. It can also help manage locally stored OneDrive files when a computer is running short of space.
Best for: Safely freeing drive space automatically on Windows
Cost: Included with Windows
Works on: Windows 10 and 11
Worth knowing: Storage Sense normally leaves the Downloads folder alone unless you change its settings. Review the Recycle Bin, Downloads and cloud-content options carefully before enabling automatic deletion.
Visit Microsoft Storage Sense help
WinContig
WinContig is a portable Windows utility that can defragment selected files, folders or traditional hard drives without requiring installation. This can be useful when a particular large file is heavily fragmented and you do not want to optimise the entire drive.
Best for: Defragmenting selected files on a traditional mechanical hard disk
Cost: Free
Works on: Windows
Worth knowing: Do not use conventional defragmentation on an SSD. Windows’ built-in Optimize Drives feature normally handles the appropriate type of optimisation automatically, so most users will not need WinContig.
Remove Empty Directories (RED)
Remove Empty Directories searches through a selected location, displays the empty folders it finds and allows you to review them before deletion. Filters and protection rules can be used to prevent particular folders from being removed.
Best for: Finding large numbers of unwanted empty folders on Windows
Cost: Free and open source
Works on: Windows
Worth knowing: Empty folders use almost no meaningful storage space and removing them will not normally make a computer faster. Review the results carefully because some applications deliberately create and expect particular folders to remain available.
Visit Remove Empty Directories
Go to…
Note: please read the disclaimer before downloading / using any software.