How to keep your identities separate online: lessons from people who got caught

Many people need more than one identity online: a whistleblower or journalist protecting a source, someone escaping an abusive ex, an activist in a country with heavy surveillance, or simply someone who wants their hobbies kept apart from their job. The technology for this (encrypted messengers, Tor, private email) is very strong. What usually gives people away is not broken encryption, but small human slip-ups.

Lessons from real cases

• An old post under a real name. The operator of a large anonymous website was linked to his real identity partly because, early on, he had promoted the site on a public forum, and later asked for help on the same forum while giving his personal email address. One link between the two identities was enough.
• One login without protection. Members of a well-known hacking group were identified after logging in to a chat service just once without hiding their real internet address.
• Trusting the wrong people. Several groups were exposed when one member was caught and agreed to help investigators. Nobody else will protect your privacy for you.

Keep each identity in its own space

1. Different usernames, emails and passwords for each identity, never reused, kept in a password manager (KeePass).
2. Different devices or profiles. On GrapheneOS use a separate profile; on a computer use Tails or a separate qube in Qubes OS.
3. Different phone numbers. Do not link an anonymous account to your real number. Use an anonymous eSIM or a rented number.
4. Never log in to both identities in the same session, on the same browser, or from the same network at the same time.
5. Pay separately. A payment in your name links you to an account. Use Monero or gift cards where you can.

Habits that identify you

• Writing style. The same spelling mistakes, favourite words, emoji, punctuation (like "!!!" or "..."), or a regional spelling can link two accounts. Software can compare writing styles automatically. Keep posts short and plain, and proofread before posting.
• Time of day. If you are always online at the same hours, your time zone and routine show. Schedule posts or vary your times.
• Personal details. Your city, job, local weather, local news, a pet's name or a holiday can each narrow down who you are. Small details add up.
• Photos and files. Pictures and documents carry hidden details such as location and author name. Clean them first with our Photo Cleaner and Document Cleaner.

Assume everything you post is permanent

Anything you post may be copied, archived and read years later. Before posting, ask: could this link my identities if someone collected everything I have ever written?