Frequently Asked Questions
The questions people actually ask, answered plainly. No shaming, no all-or-nothing. Sovereignty is a dial, not a switch — every notch counts.
Where do I even start with privacy?
Start with the thing that would hurt most if it went wrong, not the thing that sounds most hardcore. For most people that order is: password manager → two-factor authentication → encrypted messaging → email → browser → phone → everything else.
You do not need to leave every service you use, buy new hardware, or learn to code. You need one change that sticks, then another. Privacy 101 walks that path in twelve short weeks; Cypherpunk 101 goes deeper on the why.
What is digital sovereignty, and how is it different from privacy?
Privacy is about who can see your data. Sovereignty is about who controls it — who can change the rules on you, lock you out, read your files, or shut you down.
You can have privacy inside someone else’s system right up until they change the terms. Sovereignty means the important parts of your digital life keep working even when a company decides otherwise. That’s why the emphasis here is on owning the data plane, not just hiding.
Do I have to give up all my normal apps and services?
No. That framing is why most people quit before they start.
Pick what to move and what to leave. Keep the group chat your family actually uses; move your passwords and your files. Eric Hughes wrote in 1993 that privacy is the power to selectively reveal yourself to the world — selectively. Choosing what to protect is the practice, not a compromise on it.
How do I start self-hosting when I’ve never done it before?
Run one thing, on hardware you already have, that you’d genuinely miss if it disappeared. A password vault or an ad-blocking DNS server are the two best first services — small, useful daily, and forgiving of mistakes.
Concrete starting points: Vaultwarden (a self-hosted password manager) or Pi-hole (network-wide ad and tracker blocking). Once you want more than one service running, Docker and a reverse proxy are the next two things to learn. Backups should come before you have anything you’d cry about losing — which is sooner than you think.
Written guides for each of these are in progress. The command line track is the prerequisite for all of them and is published now.
What hardware do I need to run a home server?
Less than you think. An old laptop, a Raspberry Pi, or a used mini PC will run a password vault, a DNS blocker, and a few other services without noticing. Buy nothing until you’ve outgrown what’s in your closet.
Prebuilt appliances exist if you’d rather not assemble anything, and they’re a legitimate on-ramp rather than a cop-out — the point is to be running, not to have suffered.
Do I need to understand the math behind encryption?
No, and this trips up more beginners than any other belief.
You do not need number theory to use encryption correctly any more than you need combustion theory to drive. What you need is the model: what’s protected, what isn’t, who holds the key, and what happens when it leaks. The math is available when you want it and never a gate on the practice.
What’s the difference between encrypted messaging apps? Which should my family use?
The honest answer is that the channel and the endpoint are two different questions. End-to-end encryption protects the message in transit; it does nothing if the phone at either end is compromised or backing up plaintext to a cloud.
For most families, the winning move is the encrypted app they’ll actually keep using. An app everyone opens beats a better app nobody installs. Match the tool to the threat you actually have, not the one in a documentary.
Should I use a VPN? Do I need to self-host one?
A VPN moves your trust from your internet provider to the VPN company. That’s a real improvement if your provider is the problem, and no improvement at all against the sites you log into.
Self-hosting a VPN gives you a private tunnel back to your own network — great for reaching your own services from outside, useless for anonymity, since the exit is your own address. Two different jobs. Decide which one you’re buying before you pay for either.
How do I get off Gmail without breaking my life?
Gradually, and in this order: get a domain you control, set up the new mailbox, forward the old one in, change the accounts that matter (bank, government, work) a handful at a time, then let the old address idle for a year before closing it.
The mistake is switching everything in a weekend and missing something important. Email is the password-reset key to your entire life — it’s the highest-value thing to own and the one to move most carefully.
Is GrapheneOS worth it for a normal person?
If your threat model justifies it and you’re willing to lose some convenience, yes — it’s the strongest mainstream option for phone privacy. But a hardened phone you find frustrating and abandon in a month is worth less than a normal phone with the settings tightened, tracking limited, and sensible app hygiene.
Try the settings-level fixes first. If you hit their ceiling and still want more, that’s the moment the harder path earns its cost.
Do I actually need a hardware wallet for crypto?
If the amount would genuinely hurt to lose, yes. A hardware wallet keeps the key off an internet-connected machine, which is the single biggest risk reduction available.
More important than the device is understanding self-custody itself: your keys, your coins, your responsibility — including a backup that survives a house fire and a plan for what happens if you don’t. See privacy coins for how transaction privacy differs from custody — and be aware that on transparent chains, the coins you spend can deanonymize the ones you keep.
Where can I learn the Linux command line from scratch, for free?
Right here. CLI 101 starts from “what is a terminal,” then CLI 102 and CLI 103 build to real work. There’s also a command line landing page for the whole track.
You do not need to become a developer. Most sovereignty tooling assumes a terminal, so a few hours here removes the ceiling from everything else.
Can I run AI privately, without sending my data to a company?
Yes — local models run on ordinary hardware now, and the gap to hosted models keeps narrowing for everyday tasks. If you write code, the sovereign AI coding agent guide is published and is the most complete walkthrough here.
Worth reading alongside it: why local AI lies — running a model yourself removes the surveillance problem, not the accuracy problem.
Is Cypherpunk School really free? What’s the catch?
The lessons, guides, and blog are free to read, and there’s no email list, no tracker, and no account to create — see the privacy policy, which is short because there’s little to disclose.
The honest caveat: “free” describes what’s published today, not a promise about every future thing forever. If something paid ever appears it’ll be named plainly as such. Nothing currently behind you is going to move behind a wall. You can support the work if you want to; nothing changes if you don’t.
Who runs this, and why should I trust it?
Cypherpunk School is written by riv, who works in technology and has spent years going through this material the slow way — including the parts that didn’t work. More on the about page.
The better answer is that you shouldn’t have to trust it. Everything here explains why as well as how, links its sources, and describes tools you can verify yourself. Nothing on this site asks you to install something on someone’s say-so. If a guide ever does, that’s a defect — tell me.
I’m overwhelmed. What’s the single most valuable thing I can do this week?
Install a password manager and move your email and bank passwords into it, each one unique.
It is unglamorous and it prevents more real-world harm than anything else on this site. Everything else can wait a week.