Summary
Every time I unbox a new Windows machine, before I even think about wallpapers, removing bloatware, or taskbar tweaks, I run through the same short list of open-source security tools. These apps aren’t flashy, but they cover the fundamentals: credentials, encryption, network visibility, malware scanning, and secure deletion. All of them are free, auditable, and don’t lock you into a subscription just to get real protection. And given Microsoft’s headfirst dive into AI and all the telemetry Windows gathers, they’re great candidates for a first install on a new Windows machine. Bitwarden Zero-knowledge encryption, audited twice by Cure53 Setting up a Windows machine means inevitably logging into dozens of online accounts, which means the first install I do on a fresh one is Bitwarden. Reusing passwords or storing them in a browser is the single biggest self-inflicted security wound most people have, and Bitwarden fixes that without asking for money. It’s open source end to end, with the client apps released under GPL-3.0 and the self-hosted server under AGPL-3.0, so anyone can inspect exactly how the encryption works. Vault data is encrypted and decrypted locally using a key derived from your master password, meaning Bitwarden’s own servers never see your actual passwords. The free tier is unlimited across two devices, with no nag screens pushing you towards premium, and the code has been through independent audits by Cure53 in both 2018 and 2020. If you’re okay with self-hosting, there’s also Vaultwarden, a lightweight community fork of the server that runs comfortably in a small Docker container. Either way, this is the app that makes every other security decision on the machine easier, because you’re no longer relying on memorable but weak passwords. Insurance against a stolen laptop, not just BitLocker’s alternative More iterations, more transparency, no TPM required The next install is VeraCrypt, and it’s my insurance against my laptop getting stolen. It’s a free, open-source disk encryption tool that can encrypt an entire system drive with pre-boot authentication, individual partitions, USB drives, or just create a mounted virtual encrypted container for sensitive files. VeraCrypt is a fork of the old TrueCrypt project, but it isn’t stuck in the past. It uses far more password-derivation iterations than TrueCrypt ever did, and newer versions have replaced weaker legacy algorithms like RIPEMD-160 with modern ones like Argon2id. Compared to Windows’ built-in BitLocker, the biggest advantage is transparency. The source code is public on GitHub for anyone to review, it doesn’t require special TPM hardware, and it never sends your recovery key to an online account the way BitLocker can. It also supports hidden volumes for plausible deniability, which is overkill for most use cases but a nice option to have should you ever need it. On a new machine, I generally encrypt the system drive first and then create a separate encrypted container for anything I don’t want exposed in case someone accesses my machine without authorization. Finally seeing what’s actually phoning home A kernel driver that sees every packet before it leaves Windows’ built-in firewall is fine, but it’s mostly invisible, and I like seeing what programs are phoning home on my PC. This is where Portmaster comes in. It’s a free, open-source application firewall that installs a kernel-level driver using the Windows Filtering Platform so it can intercept and evaluate every network connection in real time. Instead of replacing the Windows Security firewall entirely, it layers additional privacy controls on top. This includes features like automatic tracker and malware blocklists, secure DNS over TLS or HTTPS by default, and detailed per-app rules you can tune from a surprisingly good dashboard. There is a bit of a learning curve the first time you’ll use it, since it blocks inbound connections aggressively and you may need to add explicit allow rules for things like remote desktop. But once dialled in, it makes your firewall a lot more useful. Fewer background services means fewer things to exploit A PowerShell script that removes what Windows won’t let you Another must-run tool I have for a new machine is Win11Debloat. New Windows machines can have a ton of bloatware and unnecessary Microsoft services that you don’t need. Win11Debloat is a free, open-source PowerShell script that removes preinstalled apps, disables optional telemetry, and clears out some of the ads, suggestions, and interface clutter that come with a standard Windows 11 installation. It’s not a traditional security app in the way Bitwarden or VeraCrypt is, but it earns its place here because reducing unnecessary software and background services also reduces the number of things that collect data, communicate online, or potentially introduce vulnerabilities later. Delete doesn’t mean gone until you make it gone DoD and Gutmann-standard overwrites for files that stay gone The last app on my list handles an entirely different problem: ensuring deleted files actually stay deleted. Eraser is an open-source, GPL-licensed tool built specifically for Windows that overwrites data multiple times so it can’t be recovered with standard forensic tools. It supports several recognized destruction standards, including the US Department of Defense’s DoD 5220.22-M method and the notoriously thorough 35-pass Gutmann method, and you can schedule secure erasures or trigger them straight from the right-click menu. It’s a small, unglamorous utility, but it closes a real gap, since a regular Windows delete just removes the file’s pointer while leaving the actual data sitting on the disk. Running Eraser on old drives before selling or donating a machine, or on sensitive files you’re actively removing, adds a layer of certainty that emptying the recycle bin simply doesn’t provide. Five free tools, zero monthly bills A stronger foundation, without a subscription in sight These tools give a new Windows machine a stronger foundation without turning security into a monthly bill. Whether it’s keeping your passwords safe, protecting your local data, monitoring your network, debloating a new machine, or making sure deleted files are gone for good, they’ll have your back, without asking for a cent in return. They work best alongside, not instead of, Windows Security, Microsoft’s built-in antivirus for Windows 11. No app can compensate for weak passwords, skipped updates, or reckless downloads, but this setup puts you in control from day one.