Doxxing Defense Checklist
Doxxing occurs when harassers reveal private, identifying information about someone online with the intent to cause harm. It often leads to online harassment and can escalate to in-person harassment and harm.
The information revealed could include full legal name, home address, workplace, phone number, email, photos, family members, etc.
Why this is important: Our opposition uses doxxing and online harassment because they want to create fear that will cause us to stop doing our work. The more we take steps to defend ourselves in advance, the more powerful we can be in our actions. If you wait until after you've been doxxed, the information will already be out there and beyond your control.
How doxxing turns into harassment and harm
Examples of harassment that can result from doxxing: After your information has been shared, these are the kinds of harassment that could result: sending harassing emails/messages, trying to hack into your online accounts, sending packages to your address, impersonating you online, targeting your employer to hurt your reputation, attempting to open credit cards in your name, or attempting any of these attacks to your family/friends.
The most escalated attacks could include showing up in-person to your house/workplace to attempt to harass you, vandalize your property, or harm you. It could also include calling a SWAT team on you (called "swatting"). These higher-intensity attacks happen only rarely, and should be considered unlikely if you aren't a public figure.
Pathways an attacker could use:
They could search for your name on Google or social media sites
They could use photos you've posted online to infer information about where you live or places you spend time
They could look you up on "people search" sites to get your address from your name or phone number
They could look up your phone number on Venmo to see where you're spending time based on who you're paying and when
They could use a photo of you (that they got online or took at a protest) to do a "reverse image search" to find your profiles online.
They can then share this information publicly in various ways: on a public "doxxing site" (ex Canary Mission), on social media, or in private right-wing groups.
How we can protect ourselves and our community
What we want to protect: We're first seeking to protect your home address and workplace in order to make it much harder to threaten your livelihood or yourself in-person. We also want to protect your friend lists, phone number, and email address and your mental/emotional/spiritual well-being.
Make sure to care for your emotional wellbeing: Online harassment can be very emotionally stressful even if it never escalates to in-person attacks, particularly because you are left wondering if anything is going to escalate. We're in this together. Make sure to lean on your community when preparing yourself and if any actual harassment/attacks occur.
Use this information to get bigger, not smaller
We are in this work because we're committed to transforming systems and culture. It's easy to read guides like this and think "I need to hide everything and never go outside." That kind of fear is exactly what our opposition hopes will happen if they threaten us enough. Instead, we encourage you to use these defensive measure to empower you to keep taking bold action.
The more successful you are in your work, the more likely you are to eventually face some kind of doxxing or online harassment. Consider it a sign that you're on the right track.
Are you experiencing doxxing or online harassment right now? If so, jump to the doxxing response section below.
Baseline protections
This section is for you if you're doing doing any activism or advocacy that might attract the attention of your opposition.
See how easy it is to find your home address on Google using just your name or phone number
The best thing you can do get a sense of how important it is to lock down your public profile is to search for yourself.
Later on in this guide, we will have you do a detailed manual Google search. But for now, the purpose is just to learn what private information about you is easy to access.
How to do an initial search on Google for your private info - try to find your
Search Google for the following:
"555-867-5309""Jamie Garcia" address"Jamie Garcia" phone number
Replace with your phone number and your name. Using quote is helpful but not required. If you can't find anything, try it without quotes.
Your task: How long does it take you to find your home address?
Most likely not very long. The rest of this guide will help you remove a lot of this information.
ImportantRemove yourself from “people search” sites using an automated service (like EasyOptOuts)
Using a tool to automatically remove yourself from all these sites saves a lot of time.
"People search" sites (also known as "data brokers") collect information from public and private records to form a "profile" for basically everyone. If you've ever had a phone number, used a credit card, or voted, you're probably on one of these sites.
Try it out: Search this site for your name or phone number. Most people are surprised how much information is readily available.
Why pay for automatic removal services: You can do this "opt out" process manually, but it takes an incredible amount of time, and you have to re-do it every few months when the data broker sites change. It's ridiculous that we have to pay to protect our privacy, but it saves a lot of time for us to focus on our organizing.
Which automatic removal tool should I use?
EasyOptOuts (recommended) - $20/year - It is among the most effective and the cheapest.
Optery Ultimate - $250/year - Slightly more effective if you can afford the additional investment. They can take a copy of your ID (with ID number removed) and opt you out from sites that require an ID.
What about DeleteMe? - It's the most well-known option, but it was only 27% effective at removing profiles compared to EasyOptOuts (65%) and Optery Ultimate (68%). (Source).
How to remove yourself from "people search" sites using EasyOptOuts
Time required: 5–15 minutes
Sign up for EasyOptOuts ($20/year)
Enter your personal information: Follow the prompts. It is most important to include your current information (address, phone number, email). If you can't find all your past addresses, that's okay.
Warning: Do NOT enter alias names or burner phone numbers that you use exclusively for activism that are already fully separated from your true identity. You wouldn't want those linked up inside this system.
Continue to the next checklist item to do manual opt-outs for the sites that EasyOptOuts can't handle.
Consider asking anyone who lives at your house to sign up as well. If someone finds out you live together, they could look up that person just as easily and then target you.
Timing: It can take a few days for the initial removals to complete and sometimes up to a couple of months for certain sites.
FYI: We don't get any commissions for any paid services we link to. We recommend them because they're the most effective ones we've found.
EasyOptOuts Privacy: Some people are concerned about entering all their information into a site like this. While no site is immune to data breaches, we trust this site based on their history and reputation. And the information is necessary to do removals.
Alternate tool: Kanary is a free app that searches Google for your personal info and walks you through manually removing it. It is still very time intensive and people are likely to abandon it before they finish all the removals.
ImportantManually opt-out of “people search” sites that aren’t covered automatically
Even the most effective "people search site" removal tools only cover 70% of the sites.
Some of these sites make it very difficult to remove a profile, so services like EasyOptOuts can't do it for you. These usually require you to receive an email to confirm you are the person removing the profile.
How to manually remove yourself from high-risk people search sites
Start by manually opting out of the most high-risk sites:
Opt-out of People Connect (Intelius) - They own many people search sites, so one opt-out goes a long way. Fill out the "suppression form." You will be asked to verify your email/phone.
If the site asks you to verify a phone number or email that you don’t have access to, call their technical support (877) 564-3253 and request to have your "personal information suppressed." Calling is much more effective than emailing them, in our experience.
Search for yourself on National Public Data. If you find a result, scroll to the bottom of the page and click Do Not Sell My Info to opt-out.
There are other sites you'll only find by searching for your info manually on Google (explained in a later checklist item).
Fully manual: If you would like to do all of the opt-outs manually, you can use Yael Grauer's Big Ass Data Broker Opt-Out List. Services like EasyOptOuts handle most of these for you, but not all of them. You could use this list to manually do the process at no cost, or manually search each database to see what you've missed.
Opt-out of "face search" sites
Protect yourself from a photo being used to find your identity.
You can protect yourself by opting out of "reverse photo search" sites. This makes it harder for someone to use your profile picture online to find out your legal name, which can lead to them finding you on the people search sites mentioned above.
How to remove yourself from "face search" sites
Each of these sites will (ironically) require you to upload a headshot. This is a necessary evil if you want to be removed. You have to decide if the risk of giving them more data is worth the payoff of being opted out.
Note about uploading your government ID: Some of these sites are awful and require you to upload a photo of your government ID or passport with sensitive information hidden. The easiest approach is to put tape over everything on your ID except your name and photo, then take a picture.
Sites to opt-out from:
Opt-out of Clearview.ai - Only requires a photo, not a government ID. Frustratingly, opt-outs are only possible in states that have passed privacy laws. Clearview is used primarily by law enforcement agencies, so it is important to opt-out of.
Opt-out of PimEyes - Requires a photo of your government ID. (Block out your ID number!)
Opt-out of FaceCheck.ID - Instead of uploading a government ID, you can upload a selfie you take with two fingers touching your chin. Also, you must manually select which photos you want them to remove.
Don't use your real name or photo on your Signal profile
Helps protect you from cops or attackers who want to de-anonymize you. Especially useful if you are in unvetted Signal groups.
A lot of community organizing happens in unvetted groups on Signal where you don't know how much you can trust everyone in the group. These groups can be infiltrated by right-wing adversaries and law enforcement.
Using a fake name prevents someone from finding your real identity through a Google Search.
Using a photo that isn't your face prevents someone from finding your social profiles based on an image match or facial recognition.
Both steps help defend you against doxxing and online harassment.
How to change your profile
Change your profile display name: Signal > Settings > Tap on your name/icon near the top > Click the top item with the silhouette of a person > Edit your profile display name
Change your profile photo: Signal > Settings > Tap on your name/icon near the top > Edit photo > Upload a generic photo that you found online that doesn't relate to your identity/preferences/interests/location.
Remind people in your groups to do this as well. Security is a team sport.
Enable Google's "Results About You" notifications
This can help you stay notified about pages that have your personal information.
Google offers Results About You as a tool to help you know when your private information is shared online. It's not the most helpful in removing those results, but it will help you know when you need to manually find ways to get the information removed.
How to enable Google Results About You
Enable Google "Results About You": Fill in your full name (and any other names you use), addresses, phone numbers, and email addresses.
Warning: Do NOT enter alias names or burner phone numbers that you use exclusively for activism that are already fully separated from your true identity. You wouldn't want those linked up inside Google's systems.
Wait for the initial scan to complete (a few hours)
Review the results and find ways to get them taken down:
Using the "request removal" button inside Google's tool is usually not helpful for two reasons: 1) Google will deny most requests unless they are from a "people search" site or intentional doxxing. And 2) the original information is still out there even if Google does remove it. People can find it on other search engines or the original site directly.
Instead, you want to try to contact the site owner to get the information removed. On websites, this means finding a contact form/email and telling them the page that has information you're asking to have removed. On social media sites, this might mean removing a post you made or asking the author to remove it.
Click "mark as reviewed" as you handle each item.
Submit a Google "removal request": Use this removal request form to ask Google to remove search results that have your personal information or other doxxing content. This is different than Google's "Results About Me" feature.
Watch for notification emails about new results as they come up. You'll usually see the most in the first couple weeks after you sign up.
Privacy: Requires a Google account. As with all of these opt-out services, there is a privacy trade-off. You're telling the company more information about you. This risk is usually worth it because they often have this information already, so there is little cost.
Lock down the privacy settings on your social media accounts
Most of us shared a lot more information about ourselves on social media before we started wanting to protect our privacy.
Locking down our social media profiles can take a long time.
Things you might want to protect: Your location, your email address (can be used to search for you even if it's hidden), your friend's list, your workplace, your full birthdate (can be used to gain access to other accounts like your bank), and photos/posts that show where we spend time most often.
Being bold and public vs private: Some people have intentionally public profiles with a following that they want to keep because they're using it for their activism and organizing. For example, they may choose to keep their profiles accessible while others might choose to hide their profile, so only friends can see it.
OPTION 1: How to lock down your social media privacy settings with Block Party
While you can do this manually (see below), we recommend using Block Party because it will help guide you through which privacy settings to change. It will help you lock down Facebook, LinkedIn, Instagram, X/Twitter, TikTok, Snapchat, Reddit, Strava, Venmo, Google, Google Maps Reviews, YouTube, and Bluesky. The free tier is helpful, and we've reviewed their privacy policy and generally trust the creators.
Install the Block Party extension (free) for your browser. (This is a great time to install Brave if you haven't yet!) Follow the installation prompts.
Press "Start Scan" and select which social media sites you use. Let it run for a few minutes while it checks all your settings.
Next to each site, click on "To Do" to see the recommended changes. You can start doing this manually or have Block Party automate a lot of them.
You can automate a lot of the changes: Block Party will make 50-70% of the settings changes for you automatically. This requires either a 7-day free trial or a paid account ($50/year if you use the promo code JOINTHEPARTY — we don't get any commission).
Do the remaining manual changes: Follow the "To Do" lists for each site that can't be done automatically.
Finally, consider what other social media sites you use that might not be covered by Block Party: Cash App, Partiful, Nextdoor, AllTrails, etc.
If you want to lock down all of your social media profiles, check out an app we built to help with that: Social Scrub.
If you want to delete your old X/Twitter posts or migrate to Bluesky, check out Cyd.
OPTION 2: How to manually lock down your social media privacy settings
If you don't want to use Block Party, you can do the following steps with each of your main social media accounts.
Sites you might want to prioritize (roughly in order of risk):
Facebook
LinkedIn
Venmo
Cash App
Google Maps Reviews
Yelp
Strava
All Trails
Instagram
X/Twitter (To delete your old posts, check out Cyd.)
Bluesky
YouTube
TikTok
Snapchat
Reddit
Partiful
Nextdoor
Steps for each site:
Consider deleting this profile if you don't need it anymore. If delete, you're done. If not, proceed.
Find the privacy settings screen and change all the settings to be as private as possible.
Remove your city
Hide your friends list
Remove old posts and photos that share detailed information about where you live, where you spend time, and who you spend time with.
As part of writing this checklist, we built an app to help you do the exact steps above on 160+ sites: Social Scrub.
Consider using Digital Footprint Check with usernames you commonly use to see where you might profiles that you've forgotten about.
Wear a mask to protests and public activist gatherings
This helps protect you if a bad actor tries to take photos of your face
Our opposition often shows up to protests and public activist gatherings to take photos of participants and then do a reverse image search to find out their name and other information (see how to opt out of "face search" sites above). Some organized adversaries create sites like Canary Mission to keep profiles on activists, including photos. Hiding some or all of your face makes this harder for them.
Wearing a KN95 mask can not only help you avoid being easy to find on "face search" sites and other facial recognition tools. It's not perfect, as some can get what they need just from your eyes, but it does help a lot.
As with other items on this list, being private and being bold can be in tension: Some of us may want to reduce our risk as much as possible and hide our face and eyes. Others may choose to take the risk of showing their full face because they want to be able to build more trust and convey emotions more directly.
Legal note: Some cities have passed anti-masking laws that make it illegal to wear a mask. You may want to check your local city ordinances.
Complete our Digital Security Essentials checklist
This guide covers other important doxxing protection steps like passwords, app location permissions, and software updates.
If you're concerned about doxxing, it's a good idea to complete the steps outlined in our Digital Security Essentials checklist →
Many of these will protect you against someone trying to access your accounts or devices if you're the target of doxxing.
These items from the Essentials cheklist are especially important:
Turn off location tracking for most apps
Install the latest software updates for your laptop, phone, and apps
Use a password manager
Change your existing passwords if they are weak or reused across multiple sites.
Enable two-factor authentication on your important accounts
Don't click on suspicious links
Enhanced protections
This section is for you if you're in a visibile role related to your political dissent.
Configure Signal so your phone number not discoverable
Even though your phone number isn't visible on Signal by default, people can still type in your phone number and find you. If you're at risk of harassment, you may want to only share your Signal username with folks instead.
How to make your phone number not discoverable on Signal
If you want to change your username: Signal > Profile Picture > Settings > Tap on your name/icon near the top > Tap the @ symbol > Edit username > Set the username to something completely unrelated to your identity, or any usernames you've used anywhere before. It must end in at least 2 numbers.
Hide your phone number: Signal > Profile Picture > Settings > Privacy > Phone Number > Under "Who Can See My Number" > Select "Nobody".
Make your phone number not discoverable: Signal > Profile Picture > Settings > Privacy > Phone Number > Under "Who Can Find Me By Number" > Select "Nobody".
Tell people your username instead of your phone number when you want to connect with them on Signal.
Get an alternate phone number instead of sharing your primary number publicly
Your phone number can be a quick way for people to find your home address using "people search" sites.
Sharing your primary phone number publicly not only puts you at risk of harrassing calls/texts, but if any of the "people search" sites haven't removed you, someone could use your phone number to find your home address.
How to set up alternate phone numbers
Get an alternate phone number if you need to share a phone number publicly.
Google Voice is free, but Google is where the cops will go first to subpoena information, so it's the least private option.
MySudo is $2/month for 100 texts and 30 minutes of calling.
Sideline ($15/month) or Line2 ($10/month) if you need unlimited texting/calling
When you need people to contact you on Signal, tell them your Signal username instead of your phone number. (Of course, use Signal whenever possible, especially when organizing. And make sure to turn disappearing messages on by default in settings.)
Ask people you live with to scrub their private info from "people search" sites
Everyone in your house needs to protect their info if you want your address to be private.
One of our main goals is to protect your home address from bad actors.
A motivated attacker might be able to find out who you live with through social media posts, friends lists, or family tree sites. If you've removed yourself from people search sites but your housemates or family members haven't, the attacker might still be able to find your home address.
How to support the people you live with to remove their private info
Ask each person you live with to remove their private info from "people search" sites. Example text/script:
I'm working to remove our home address and my other private info from the internet, so we are more protected. Can you take a few minutes to do the first two items on this checklist so our address isn't easy to find online: https://activistchecklist.org/doxxing
I'm happy to sit down and do this together if you have time this week.
If it's helpful, you can search for your address on Google and find specific pages where their name is attached to the address. You could send them the link to this page to help show why it's important. Most people are surprised to discover how easy it is to find information like this online.
Set a reminder to follow up with them in a week or so to see if they need any support.
You might also make the same request of people who used to live with you at your current address, since their former address is still on "people search" sites.
Do a manual Google search for your private info
There are always going to be results you have to find and remove manually.
If you only rely on automatic data removal tools like EasyOptOuts, there will likely still be a lot of results that show your private info.
We're most concerned with removing your current home address and, secondarily, your phone number. Your email might be public and lead to harassment, but it's easier to manage.
The Kanary app (free tier) can help you do some of this searching work.
How to find and remove your personal info on Google
Do separate google searches for your info. Use quotes around your search to get more accuracy. Scroll through the first 2–3 pages on Google for each search (don't use Brave Search or other privacy search engines for this task).
Home address in quotes:
"742 Evergreen Terrace, Springfield"or even just"742 Evergreen Tr"though that may turn up too many results that aren't in your city.Phone number in quotes:
"555-867-5309"or"5558675309"or"(555) 867-5309"Full name plus city (each in separate quotes):
"Jamie Garcia" "Springfield"Just your full name in quotes:
"Jamie Garcia"(will produce a lot of results that might not be you)
Keep a list of what you find that includes your sensitive private info. Prioritize sites that list your address or phone number.
Make a plan to get each one removed.
If it's a "people search" site, look for a "do not sell my info" or "opt out" form to fill out.
If it's a social media site, the author needs to remove it. Or you can try to press "report content" if they're unwilling to remove it.
If it's some other site, look for a contact form and ask them to remove it because you're concerned about being the target of online attacks. Most sites are willing to help.
Set a reminder to check back in. Check in after a week. If you didn't hear back from any of these sites, try to follow up.
Set up Google Alerts for each search above so you're notified when new items come in. (Google's "Results About You" is good but it definitely misses things.)
Refresh the Google results. If you got a listing removed on the source site, but it's still showing up in Google's results, you can request the content be updated.
Freeze your credit reports
Protects against someone trying to open credit cards in your name.
A bad actor might try to open credit cards in your name, which can damage your credit score and create long-term financial difficulties.
Freezing your credit report prevents anyone from opening cards/loans in your name. You can temporarily unfreeze it when you need to.
How to freeze your credit report
You must manually place a "freeze" on all three of the credit bureaus:
This is always free. Don't accept any paid offers they make.
You will need to remember to temporarily lift the freeze when you need to run a credit report to open a new account in the future.
Blur your house on Google Maps and Apple Maps
This makes it harder for a bad actor to know the layout of your house/yard.
If a bad actor can get ahold of your address, they might try to find your house on Google Maps if they intend to harass or harm you in-person. Or they might be able to learn things like what kind of car is parked in your driveway.
How to blur your house on map sites
Note: You cannot undo a blur once you request it. For most folks, there's very little upside to having your house visible on street view.
Blur your house on Google Maps (details):
Find your home on Google Maps.
Open the Street View image that you want to blur.
In the bottom right, click “Report a Problem” and complete the form indicating that you want to blur your house for privacy reasons.
Blur your house on Apple Maps:
Email mapsimagecollection@apple.com. Include your home address and explain that you'd like it blurred for privacy reasons.
Remove your house from real estate sites (Zillow, Redfin, etc.)
Hiding photos of the inside of your house helps keep everyone safer.
Zillow, Redfin, Realtor.com and others often show not just the outside of your house (which presents some risk) but can show a detailed layout of the inside of your house. This can give the opposition information that might help them harass or harm you.
You can protect against this by requesting the images be removed for your address.
How to remove images of your home from real estate sites
If you do not own the home, you may need to ask your landlord to do these removals since they require an account on each site. They have to "claim" the house on each real estate site.
You can also first search on the site to see how detailed the photos are and whether you want them removed.
Realtor.com: Log in > Claim Home > Edit Photos
Ask your real estate agent to remove the photos from the MLS so they disappear from any other sites.
Enable Lockdown Mode (iPhone) or Advanced Protection (Google & Android)
Mercenary spyware is an extremely advanced attack, exploiting sophisticated vulnerabilities on our devices. In response, Apple and Google have introduced an advanced security mode that offers enhanced protection against spyware.
On iPhones, it's called Lockdown Mode and on Android, it's called Advanced Protection Program. (You can also enable Advanced Protection Program on just your Google Account even if you don't have an Android phone.)
We have no reports of anyone getting infected with spyware who had Apple's Lockdown Mode enabled. Android's Advanced Protection is more recent and its effectiveness has yet to be tested.
Usability trade-offs: There are some functionality sacrifices you make for this additional protection. See the lists below. If you encounter issues that don't work for your needs, you can always disable the feature later.
How to enable Lockdown Mode for iPhones
iPhone: Settings → Privacy & Security → Lockdown Mode → Enable
Enabling Lockdown Mode introduces some usability tradeoffs on your phone. See list below.
This feature is available for iOS version 16 and above.
How to enable Advanced Protection on Android
Android: Settings → Security & Privacy → under "Other Settings" tap Advanced Protection.
Note: The location of this setting may vary between Android devices, so we recommend searching for 'Advanced Protection' in the Settings search bar.
This feature is available for Android 16 and above.
Usability trade-offs
For anyone worried about targeted attacks, these usability trade-offs will likely be worth the big increase in security.
iPhone Lockdown Mode: Features that will be harder to use
No clickable links in messages (mainly within iMessage) - Links show as raw URLs and don't work (i.e. are not instantly clickable). You have to copy-paste them manually to a browser. This encourages you to make sure they are safe before doing so, since spyware often arrives via a text message containing a custom-designed link that is impossible to ignore for you in particular.
Most message attachments blocked (also mainly within iMessage) - When receiving PDFs, documents, Office files, contacts, location over iMessage, you might not be able to view them normally and iMessage will indicate "1 attachment." This is because some spyware can be delivered through malicious attachments.
FaceTime calls from unknown contacts blocked - Lockdown Mode will block call attempts from unknown contacts or people you have not been in touch with in the last 30 days. You will be notified if this user attempts to FaceTime you and you can decide to call back if the call attempt is genuine.
Web fonts don't load - Websites appear with system fonts only, often looks weird.
Images may not display - Some images show as missing image icons.
Interactive webpage elements fail - Complex web features, animations, dynamic content often broken.
Location sharing is disabled in Find My. You can see other people's locations but they can't see yours.
iCloud Shared Albums don't work as expected - When you share photos in a shared album, location information is excluded. Shared Album invitations might be blocked too.
Device won't connect to any WiFi automatically - On Lockdown Mode your phone won't connect to insecure WiFi's automatically and you will need to manually connect to the chosen network and accept the security risk.
2G or 3G support is turned off - If you find yourself in a location with 2G or 3G cellular network with Lockdown Mode, your phone will simply not connect (as 2G / 3G is more insecure than 4G / 5G).
Learn more about Apple's Lockdown Mode.
Google/Android Advanced Protection Program:
Security key required - Must use security key/passkey for every new device sign-in to Google Account, which can take some getting used to.
JavaScript optimizer disabled (Chrome) - Some complex websites may not work properly.
No sideloading - Can't install apps from outside Play Store or verified stores.
USB locked when device locked - Must unlock device before connecting USB accessories.
Insecure Wi-Fi blocked - Won't auto-connect to open/WEP Wi-Fi networks.
Enhanced Safe Browsing warnings - More download warnings and potential blocked websites.
Fast charging might not work as expected - You might need to unlock the phone in order to activate fast charging.
Learn more about Android Advanced Protection Program.
Enable Signal PIN and Registration lock
Protects you from advanced attacks where someone "steals" your phone number and registers it on Signal
A highly-motivated attacker could try to take over your cell phone number through something called "SIM Swapping" or by trying to call your service provider and initiate a phone number "port" to a new provider. They could then use your phone number to register a Signal account and start receiving messages meant for you.
These are advanced attacks that don't happen to most folks. Still, it is easy to protect your Signal account.
You can protect yourself by enabling registration lock on Signal. It prevents someone from hijacking your account even if they steal your phone number. No one will be able to register a new Signal account on your number until your account has been inactive for 7 days.
If you forget your PIN, you will have to wait 7 days before you can create a new account (and your contacts will not be recovered). More on PINs & registration lock.
How to enable Signal PIN and registration lock
Enable registration lock: Signal mobile app > Profile Picture > Settings > Account > Enable "Registration Lock"
Upgrade your PIN: You had to set a Signal PIN during setup. If you don't remember it or want to use a stronger PIN, here's how:
Generate a strong PIN: For maximum security, use a PIN that is 8 or 10 digits and make sure it is computer-generated. Here's a random PIN generator you can use.
Set a Signal PIN: Signal mobile app > Profile Picture > Settings > Account > Create/Change PIN (If you don't already know what your PIN is).
Save your PIN or enable PIN reminders: If you have a password manager you use reliably, save your PIN there. If you think you might forget where you saved your PIN, leave "PIN reminders"
High-profile protections
This section is for you if you might end up receiving major media attention related to your dissent or your adversaries have a lot of resources.
Invest in advanced data removal services (ex: Optery Ultimate)
If you're at very high risk of being attacked for your politics, you'll want to make sure you've done a thorough job scrubbing your data online.
Start by upgrading your automated data removal tool from EasyOptOuts to something like Optery Ultimate ($250/year). It is among the most comprehensive automated opt-out tools. You can also consider Kanary Pro plan ($10/month) for some additional coverage.
Depending on your risk level, you may want to invest in a high-end service that can do thorough data scrubbing for you.
Activist-aligned data scrubbing and doxxing response services:
You can also check out the Access Now Helpline which is usually free, but much slower and less thorough.
Do an advanced social media scrub and lockdown everything
The basic social media lockdown steps above are a good start. If you're at high risk of being targeted, you should do a more detailed scrub.
How to do a detailed social media scrub and lockdown
Getting started
We built Social Scrub to help you track your progress while you lock down dozens of social sites. It supports over 160 and you can add your own.
It reminds you of the main steps for each site:
Delete the profile if you don't need it anymore
Change display name (it generates a random one)
Change your username (it helps you generate a ranomd one)
Remove your profile picture
Remove your location from your bio
Hide posts and photos that might reveal your location
Hide your friends list
Change your email address (consider DuckDuckGo Email Protection or the Gmail "plus trick".
Change your privacy settings.
This may take many hours to complete. Bookmark the link or email it to yourself so you come back to it.
Tip: You can also use this identity generator if you need a random profile picture.
Tip: Search for your common usernames on Digital Footprint Checker and Instant Username. Use the results to do step 1 (below) and fill in additional sites (near the end of the spreadsheet) where you have had accounts that are not already listed elsewhere on the spreadsheet.
Set up a PO box so you can stop giving out your home address
You may want to stop giving out your real street address when registering for services, getting packages delivered, etc.
Options:
PO box with USPS: The main downside is that FedEx and USPS will not deliver to a PO box.
UPS Mailbox: More expensive, but accepts mail from USPS and FedEx, while also maintaining increased privacy.
iPostal1: Gives you mail scanning + physical pickup, and it also allows delivers from all shipping services (including FedEx and UPS) that won't always deliver to PO Boxes. Comes with a privacy risk if their services are ever b reached, or they get a court order to turn over data about you.
Note: UPS Mailbox and any "virtual mailbox" service like iPostal1 that you use will require you to provide government ID and sign a form (USPS Form 1583) that is submitted to USPS.
Use a unique identity for every online account you make (name, email, username, phone number)
Instead of signing up with your real name/email/phone/etc., you can start using random, unique identities for each account.
This makes it harder for attackers (and tech companies) to link your accounts across sites and create a profile from all those bits of information.
How to use a unique identity for each account
Make sure each of these is unique for each site, whenever feasible:
Display name: Use this random identity generator.
Username: Use this identity generator or this specific username generator.
Profile photo: Leave it blank or use this identity generator. If you use the same photo on all sites, an attacker can do a "reverse image search" to find all your accounts.
Email address - Use an email alias service like:
DuckMail (free, requires browser extension)
Proton Mail (free/paid)
Addy.io (free/paid)
Phone number: Try to just not enter a phone number when prompted. If you need to enter a phone number just for verification when you sign up, try renting a phone number from SMSPool ($0.50 per registration).
Help the people around you defend their private info (family, friends, co-workers, comrades, neighbors)
If you are a high-risk target, you should evaluate the likelihood that others in your life might be targeted as part of harassing/harming you. This is very common when an activist makes front-page news. Right-wing trolls and vigilantes will go after family members, housemates, friends, co-workers, comrades, neighbors.
Message people in your life and suggest they do at least the first section of this guide.
Here's the link to the checklist you're currently viewing: https://activistchecklist.org/doxxing
Having these conversations can be challenging sometimes (especially with family members). It may take time to explain to someone why they are at risk because of actions you are taking.
You may also want to inform your employer in advance that you are at risk for harassment in case they get any suspicious/concerning calls about you.
Make a personal emergency plan in case you are threatened at home
The highest level of attack from doxxing involves someone finding you in-person at your home or in your life to harass, threaten, or attempt to harm you.
Follow our Personal Emergency Planning Checklist →
These sections of that checklist are especially relevant when it comes to doxxing risks:
Section 3: Home Safety
Section 4: Evacuation Planning
Add a security PIN to your bank and cell phone accounts
Your bank accounts and cell phone provider account are high-value targets where you want to add extra protections. Some of these places will only try to verify with your phone number, address, and/or date of birth. All of these are kinds of information someone could find online about you.
Adding a PIN or other security measures helps make sure you are the only person who has access.
How to add a PIN to sensitive accounts
Here are some of the accounts you'll want to secure.
Bank, credit card, loan, mortgage, and investment accounts
Your cell service provider (Verizon, T-Mobile, AT&T, etc.)
Internet provider
Utility companies
Insurance (health, home, auto, etc.)
How to add a PIN for each account:
Call their customer service line.
Ask if you can add a verification PIN.
Generate a random PIN for each account.
Save it in your password manager.
If you can't add a PIN, ask what other security features they offer to prevent someone from pretending to be you and accessing your account.
Install a trusted VPN with ad-blocking to make it harder for cops to do warantless survillance
A VPN makes it harder for websites to track you and prevents your internet provider from logging your traffic.
Anytime you connect to the internet (phone or computer), your internet provider is revealing your approximate location to every site/app you use.
We know that law enforcement agencies are using tools that to track your location using data gathered from apps you have and ads you see. Using a VPN with ad-blocking features enabled makes it much harder for them to track you. Also, police can get a subpoena for your internet traffic from your internet provider.
A VPN (Virtual Private Network) helps mask your location and makes you slightly harder to identify.
A VPN with ad-blocking enabled is especially important on your phone.
A VPN doesn't make you fully anonymous. For sensitive browsing requiring higher anonymity, consider Tor Browser as a second browser alongside your everyday one.
Options: All of these are very trustworthy options.
Mullvad VPN (top recommendation) -Better privacy since payment info isn't stored, but you need to manually pay each cycle.
IVPN can be easier because it automatically renews.
Proton VPN has a solid free plan, but it is only for 1 device. To get ad-blocking, you need a paid plan. (See our note regarding concerns about the Proton CEO and why we still offer Proton options.)
How to set up Mullvad VPN
Mobile app
Create an account number and write it down: Create a Mullvad account number (there is no password) and write it down somewhere safe like your password manager.
Pay (aka "Add time"): There is no automatic renewal, so all payments are manual. Paying yearly can make things easier so you don't have to remember.
Install the Mullvad mobile app (iPhone, Android) and use your Account number to sign in.
Enable ad-blocking: Gear Icon ⚙️ > VPN Settings > DNS Settings > DNS content blockers > Enable Ads, Trackers, and (optionally) Malware
Desktop app
Install the Mullvad desktop app (Mac, Windows). Get the Account Number from the phone app.
Enable autoconnect: Find Mullvad in your toolbar > Gear Icon ⚙️ > VPN Settings > Enable "Launch app on start-up" and "Auto-connect"
Enabled ad-blocking: Find Mullvad in your toolbar > Gear Icon ⚙️ > VPN Settings > DNS content blockers > Enable Ads, Trackers, and (optionally) Malware
We recommend keeping your VPN on at all times unless you're having trouble connecting to a site (see below).
Note: Instead of a credit card, you can also order a voucher card for Mullvad or IVPN so that your identity is even more protected. (Yes, we hate Amazon too, but that's the only place online you can buy these cards.)
Downsides to using a VPN
You will encounter more CAPTCHAs on websites
Some websites may block VPN access, and you'll have to disable it and remember to re-enable it later
Some streaming services might not work
If you experience odd behavior on websites, always try turning off the VPN temporarily to see if it will load.
Note: You must use a trusted VPN that doesn't keep logs of your internet traffic and will push back on government requests. We've vetted our top recommendations.
Tools summary
We link to many tools in this guide and we wanted to capture them in one place:
🛡️ Social Scrub: App we built to help you keep track of which social media profiles you have locked down and which you still need to complete.
Google "Results About Your" feature: Notifies you when your personal information appears in a new result on Google.
EasyOptOuts ($20/year): Removes your info from all the "people search" sites.
Block Party: Walks you through the exact settings you want to change on each of the most popular social media sites.
Cyd: Helps you delete/backup your X/Twitter posts (and optionally move them to Bluesky).
Identity generator from StrongPhrase.net: Helps you have random name/username/etc to put on each site.
MySudo or Google Voice: Get a secondary phone number so you don't have to share your real number.
DuckMail or Proton Mail or Addy.io: Offer an email alias service so you use a unique email address on each site that can't be correlated across sites.
SMSPool: Let's you rent a random phone number for a few minutes to get a verification text when signing up for services that require a phone number.
Optery ($250/year): For high-threat users. Does the same thing as EasyOptOuts, but goes a little further. (People often suggest DeleteMe, but Optery is more effective.)
Note: Tools only get you so far, some steps have to be done manually.
Responding to doxxing and online harassment
We don't yet have a full doxxing response guide, but we do want to offer some starting points.
Doxxing response:
Prioritize your physical safety: Go to a friends house or a safe house if you are worried you might be at risk of imminent harm or harassment. Trust your gut. It's better to lean on support and find out nothing happened than the opposite.
Take care of your emotional wellbeing: Even supposedly "minor" harassment can be very stressful because you don't know if the threats are going to materialize. Take care of yourself.
Get support: Don't do this alone. Have someone by your side for every step of this.
Find friends/comrades who check in with you frequently and help you stay grounded.
Reach out to get expert support: Access Now 24/7 Helpline (free), Equality Labs, Brightlines (high-end), Convocation Research & Design (high-end).
Document everything: Don't delete it or block anyone. It can be helpful for tracking down the people behind the attacks later. Delegate this to a supportive person if you need to. How to document.
Don't call the cops: Law enforcement could use an investigation to learn more about activist networks. That said, there might be some situations where local anti-harassment laws could support you. Consider consulting with a movement aligned lawyer before you contact the State and/or bring law enforcement into your situation. Movement-aligned lawyers you might consider: CLDC (rapid response hotline: 541-603-6891) or NLG.
Learn more about how to respond:
Right To Be - Doxxing Response Guide
Right To Be - Self-Care guide
PEN America - What to do if you've been doxxed or places on a watchlist
PEN America - Online Harassment Field Manual - Doxxing response
Crimethinc - Prevention and Aftercare for Those Targeted by Doxxing and Political Harassment (2020)
Keep learning with these related guides
Have Questions?
Let us know if you have questions or feedback so we can make these guides as useful as possible.