Privacy & self-hosting hardware
Travel router, two security keys, an encrypted stick, a Pi-hole. Each one quietly closes a door.
Privacy hardware is about removing single points of failure: your hotel's Wi-Fi, your phone's SMS codes, a lost USB stick, a webcam you forgot about. None of this requires paranoia. Each item is a one-time purchase that quietly closes a door, and most double as self-hosting tools.
Pair it with free software: Tailscale (mesh VPN back to your own network), Bitwarden or 1Password, Signal, Pi-hole or AdGuard Home, uBlock Origin, DNS over HTTPS via NextDNS or Quad9, and Immich or Nextcloud on the homelab kit box for photos and files. Mullvad at $5/month, payable in cash, if you want a commercial VPN for the rare case your own endpoint is not enough.
The kit
Slate 7, two YubiKey 5C NFCs, the keypad Apricorn, a Faraday bag. The complete set for a travelling developer.
Budget is our editorial estimate (USD, Oct 2026) from the sum of items you keep. It is not an Amazon price; check live prices on Amazon.
- 01 · Travel router$$
GL.iNet Slate 7 (GL-BE3600) Wi-Fi 7 travel router
Wi-Fi 7, dual 2.5G, ~540 Mbps WireGuard, a touchscreen for toggling the VPN.
The Beryl AX's successor for people who want faster tunnels and Wi-Fi 7 clients. Same OpenWrt base, same Tailscale and AdGuard integrations. The Flint 2 (GL-MT6000) is the stay-at-home counterpart that serves as the fast WireGuard endpoint.
- wifi
- Wi-Fi 7 BE3600
- ports
- 2× 2.5GbE
- vpn
- WireGuard ~540 Mbps
- 02 · Security keys×2$$
Yubico YubiKey 5C NFC
FIDO2 passkeys, TOTP, PIV, OpenPGP and NFC in one IP68 key. Buy two.
Authenticator apps can be phished; FIDO2 keys cannot. One key covers Google, Apple, Microsoft, GitHub and your password manager, and NFC makes it work with your phone. Buy two and enrol both everywhere, because losing your only key is the number-one lockout story. The $29 Security Key C NFC is FIDO-only and fine if passkeys are all you need.
- protocols
- FIDO2, U2F, TOTP, PIV, OpenPGP
- connectors
- USB-C + NFC
- rating
- IP68
- 03 · Encrypted USB$$
Apricorn Aegis Secure Key 3NXC (keypad, USB-C, 128GB)
PIN keypad unlocks with no software, on any OS. What IT departments buy.
Hardware AES-256 XTS, FIPS 140-2 Level 3 tamper-evident epoxy, brute-force self-destruct, and it works on a machine you cannot install anything on. The Kingston IronKey Vault Privacy 50 is the $60 software-unlocked alternative; a VeraCrypt container on any stick is the free one.
- encryption
- AES-256 XTS hardware
- unlock
- onboard keypad
- certification
- FIPS 140-2 L3
View on Amazonpaid link - 04 · Pi-hole box$
Raspberry Pi Zero 2 WH starter kit (headers, case, PSU)
A $35 Pi-hole or AdGuard Home that blocks ads and trackers for every device, including the TV.
512MB and a quad-core are plenty for household DNS filtering. If you built the homelab kit, run Pi-hole as a Proxmox container instead and skip this. A Pi 4/5 adds room for Unbound recursive DNS and Home Assistant.
Skip if you run Pi-hole on a homelab node.
- soc
- RP3A0 quad-core
- ram
- 512MB
- radio
- Wi-Fi + BT
View on Amazonpaid link - 05 · Camera covers$
Ultra-thin 0.7 mm webcam slide covers (3-pack)
Eight dollars of plastic that defeats the whole class of 'malware turned on my camera'.
Buy the 0.7 mm version so a laptop lid still closes. MacBooks are the exception: Apple warns that anything thicker than about 0.1 mm can crack the display, so use a sticker-type cover there. Add a mute switch or a mic-blocker plug if the microphone worries you too.
Find on Amazonpaid link - 06 · Faraday bagoptional$
Mission Darkness Non-Window Faraday bag for phones
Lab-tested shielding that actually blocks cell, Wi-Fi, Bluetooth, GPS and NFC.
Many 'RFID pouches' leak at cell frequencies; MOS Equipment publishes attenuation data. Useful at borders, at protests, or just to stop a relay attack on a keyless car (buy the key-fob size for that). The Dry Shield sleeve is the waterproof variant.
View on Amazonpaid link - 07 · Hardware walletoptional$$
Trezor Safe 3 hardware wallet
Open-source firmware with a secure element. Only if you hold crypto, and only new.
Fully open-source, EAL6+ secure element, passphrase support. Ledger has broader coin support and Bluetooth but closed firmware. BitBox02 if you are Bitcoin-only. Whatever you pick, buy from the manufacturer or its official Amazon storefront and never second-hand.
Only if you hold crypto.
Skip this / common mistakes
- !
Don't buy one YubiKey. Losing your only key is the number-one lockout story; buy two and enrol both.
- !
Don't buy a YubiKey Bio or FIPS variant for personal use. The standard 5C NFC does everything.
- !
Don't buy a hardware wallet second-hand or from a third-party marketplace seller.
- !
Don't rely on a travel router's VPN without pointing WireGuard or Tailscale at your own endpoint. The router is only as private as where it tunnels to.
- !
Don't put a thick webcam cover on a MacBook. Cracked displays are a known result; use a sticker type.
Questions people ask
Do I need a YubiKey if I use an authenticator app?
TOTP codes can be phished in real time; FIDO2 keys cannot be. For Google, Apple, Microsoft, GitHub and your password manager, a hardware key is a meaningful upgrade, and passkeys on the key work across all your devices.
Which GL.iNet router should I get?
Beryl AX for travel on a budget. Slate 7 if you want Wi-Fi 7 and a faster tunnel. Flint 2 as the always-on home router and WireGuard server the travel router connects back to.
Is a travel router safer than hotel Wi-Fi?
Yes. One device authenticates to the hotel, all your devices sit on your own encrypted network behind it, and the tunnel home means the hotel sees nothing but encrypted traffic to one address.
Pi-hole or AdGuard Home?
Both block ads and trackers network-wide. AdGuard Home has built-in DNS-over-HTTPS and a friendlier UI; Pi-hole has the larger community and more guides. Either runs happily on a Pi Zero 2 W.
Sources
Heads up: links to Amazon are affiliate links. As an Amazon Associate I earn from qualifying purchases. It costs you nothing and does not change which products get picked. How this works
Pairs well with
Homelab starter kit
A sub-20 W mini PC running Proxmox, a NAS for the data, and a UPS so a power blip never eats your drives.
Raspberry Pi & electronics bench
A Pi 5 that doesn't throttle or brown out, a Pico for the bare-metal stuff, and the iron and meter that outlast every project.
Run a local LLM at home
From a $800 Mac mini to a 512GB Mac Studio: the hardware that actually fits the model you want.
Readers of this kit also open
From a $800 Mac mini to a 512GB Mac Studio: the hardware that actually fits the model you want.
A sub-20 W mini PC running Proxmox, a NAS for the data, and a UPS so a power blip never eats your drives.
No soldering. A hot-swap kit, switches and keycaps you chose, and the three tools worth owning.
Monitor at eye height, a chair that fits, a desk that lets you stand. Buy those first; cheap out on the rest until it bugs you.
Spotted a better part, or a price that moved? Tell us. Every kit is re-checked when the hardware changes. All kits.