Loading page
About this tool
28-point Windows 11 privacy audit: advertising ID, diagnostics, activity history, Recall, app permissions and BitLocker, scored by risk profile.
This checklist scores a Windows 11 PC against 28 real privacy and security settings — the advertising ID, diagnostic data level, Recall snapshots, activity and clipboard history, cloud content search, OneDrive folder backup, location and microphone permissions, and BitLocker device encryption — weighting each by how much data it actually stops leaving the machine or sitting readable on it. Four settings are marked critical and hold the score at 69% while any of them is open, because an unencrypted disk or a fully enabled Recall index outweighs any number of minor toggles. Five risk profiles re-score the same list, so a shared family PC is graded on local recording while a machine you want quiet on the network is graded on telemetry and cloud sync.
Open Windows 11 Privacy Settings Checklist on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Disk encryption and the diagnostic data level carry far more points than cosmetic toggles, because that is where the exposure actually is.
Both the off switch and the app and website exclusions are scored, since a filtered Recall is a very different risk from an unfiltered one.
The checklist runs entirely in your browser, reads nothing from your PC, and never asks for a Microsoft account or password.
Open Settings > Privacy & security > Recall & snapshots and turn off snapshot saving. Recall is opt-in and only appears on qualifying Copilot+ PCs, so on most machines there is nothing to disable — check rather than assume. If you want to keep it, use the same page to exclude your password manager, banking sites and messaging apps and to cap how much history it stores.
It is a per-user identifier on your device that apps can read to link your activity across otherwise unrelated programs. Turning it off under Settings > Privacy & security > General resets the identifier and stops apps requesting it. You still see ads; they are simply no longer joined up by that shared ID.
No, and nothing in Windows does. Required-only keeps the minimum Microsoft uses to keep the device secure, up to date and working, and drops the optional tier — which is the one that includes browsing activity, detailed feature usage and enhanced error reports. Use the Delete diagnostic data button on the same page to clear what was collected before you changed the setting.
Not universally. Device encryption is enabled automatically on many modern machines that meet the hardware requirements and are signed in with a Microsoft account, but plenty of configurations ship without it. Check Settings > Privacy & security > Device encryption, and if you enable it, back up the recovery key somewhere you can reach without that computer.