An XDA report this month confirmed what a lot of Windows 11 users half-suspected: the operating system quietly forwards typing and inking samples to Microsoft unless you dig into a specific setting under Privacy & security and switch it off. Flipping that one toggle is a start, but Windows spreads its telemetry across dozens of surfaces (diagnostics, activity history, tailored experiences, Edge suggestions, Copilot inputs, error reporting, cloud clipboard) and each one lives in its own menu. That is why the best apps for Windows telemetry blocking exist as a category: they audit every switch at once, block the outbound endpoints, and give you a single dashboard to see what is still leaking. Below are seven tools that cover Windows 10 and Windows 11, all free, most of them open-source.
What to look for in a Windows telemetry blocker
Not every “privacy tool” for Windows is worth installing. The good ones share a short list of traits:
- Broad coverage across settings and services. A useful tool covers system telemetry, Edge and Bing search, Cortana, Copilot, tailored experiences, activity history, inking and typing personalization, and cloud clipboard in one pass. One-toggle apps miss too much.
- Reversible with an undo path. Windows updates reset registry keys. A blocker that lets you re-apply your profile after each cumulative update, or roll back a specific tweak when something breaks, saves hours.
- Actively updated for the current Windows build. Microsoft renames services and adds new telemetry endpoints with every feature update. Tools that stopped shipping in 2022 leak on 24H2 and later.
- Does not break Windows Update or Defender. Aggressive blockers that null-route update.microsoft.com will leave you unpatched. Look for tools that separate telemetry endpoints from update infrastructure.
- Ideally open-source. Privacy software you cannot audit is a leap of faith. The GitHub-hosted picks below all publish their tweak lists.
- No paid license required for core function. Every tool on this list has a free tier that does the actual blocking. Paywalled “privacy” utilities are a red flag.
Quick comparison
| App | Best for | Free | Open source | Standout |
|---|---|---|---|---|
| O&O ShutUp10++ | One-click Windows 10 and 11 privacy audit | Yes | No | Portable, no install, 100+ settings |
| W10Privacy | Granular control with per-tweak notes | Yes | No | Color-coded risk levels for every toggle |
| WindowsSpyBlocker | Blocking telemetry servers at the network layer | Yes | Yes (MIT) | Curated hosts and firewall rulesets |
| Privatezilla | Auditing Windows 10 privacy in a checklist UI | Yes | Yes | Community PowerShell add-ons |
| Win11Debloat | Removing bloat and telemetry from Windows 11 | Yes | Yes (MIT) | PowerShell script, no install |
| simplewall | Blocking outbound Microsoft traffic per-process | Yes | Yes (GPL-3.0) | Uses Windows Filtering Platform directly |
| Portmaster | Whole-system network privacy with DNS-over-HTTPS | Yes | Yes (GPL-3.0) | Per-app rules, encrypted DNS, malware blocklists |
The apps
1. O&O ShutUp10++: best one-click audit
O&O ShutUp10++ is the tool most Windows users reach for first, and with good reason. The portable executable ships as a single file, opens a categorized list of over a hundred privacy switches (telemetry, location, Cortana, Edge, OneDrive, activity feed, tailored ads), and marks each one with a recommendation. A “Actions” menu applies the vendor’s recommended profile in one click, or you can walk through settings individually. The “++” build adds Windows 11 coverage, including Copilot and Recall-adjacent toggles.
Where it falls short: It is freeware, not open-source, so the tweak logic is not auditable line-by-line. It also does not touch outbound network traffic, so telemetry endpoints Windows re-enables after a feature update will start reporting again until you re-run the tool.
Pricing: Free for private and business use.
Platforms: Windows 7, 8.1, 10, 11.
Download: O&O ShutUp10++ from oo-software.com
Bottom line: The fastest way to close every well-known Windows telemetry surface at once. Re-run it after each Windows feature update.
2. W10Privacy: best for granular control
W10Privacy is what you graduate to when ShutUp10 stops feeling detailed enough. The German-built tool color-codes every setting by risk (green is safe, yellow reversible, red potentially breaking), groups tweaks by subsystem, and includes an inline description of what each toggle actually does at the registry or group-policy level. It covers Windows 10 and 11, adds Edge and Office switches, and can export a settings profile so you can re-apply the same configuration on a fresh install.
Where it falls short: The interface has a learning curve, and translated tooltips occasionally lag the German original. The tool is donationware, not open-source.
Pricing: Free (donations welcome).
Platforms: Windows 10, Windows 11.
Download: W10Privacy from w10privacy.de
Bottom line: The pick when you want to understand every tweak before you flip it, and to save your profile for re-use.
3. WindowsSpyBlocker: best network-layer blocker
WindowsSpyBlocker takes a different approach: instead of flipping registry keys, it maintains a curated set of hosts-file entries and Windows Firewall rules that block outbound traffic to Microsoft’s known telemetry endpoints. The lists are grouped by “spy,” “update,” and “extra” so you can block diagnostics without cutting yourself off from Windows Update. Written in Go, distributed as a single portable binary, and updated on GitHub as new endpoints appear.
Where it falls short: Command-line driven, so less friendly for casual users. Aggressive rulesets can cause Store apps or Xbox services to misbehave until you re-allow specific ranges.
Pricing: Free and open-source (MIT).
Platforms: Windows 7, 8.1, 10, 11.
Download: WindowsSpyBlocker on GitHub
Bottom line: Pair it with a settings tool like ShutUp10 to catch anything the toggles miss on the network side.
4. Privatezilla: best audit checklist
Privatezilla scans about sixty of the most important Windows 10 privacy settings and displays each one as “Configured” or “Not configured” in a plain checklist. You tick what you want changed and hit apply. A companion community package adds PowerShell scripts for telemetry blocking, forced app removal, and OneDrive uninstall. The whole thing is open-source and small enough to read the source in an afternoon.
Where it falls short: Primary focus is Windows 10; Windows 11 coverage is thinner than in W10Privacy. Some newer AI-era toggles (Copilot, Recall) may not appear in older builds.
Pricing: Free and open-source.
Platforms: Windows 10 (1809 through 22H2), partial Windows 11.
Download: Privatezilla on GitHub
Bottom line: Best when you want a checklist you can audit yourself, and a clear before-and-after view.
5. Win11Debloat: best for Windows 11 out of the box
Win11Debloat by Raphire is a single PowerShell script that turns a stock Windows 11 install into something much quieter. It disables telemetry, diagnostic data, activity history, app-launch tracking, and targeted ads, then removes preinstalled Store apps, lock-screen suggestions, and Microsoft 365 promo tiles. Presets range from light cleanup to full debloat, and you can pass individual switches from the command line for scripted deployments.
Where it falls short: Script-based, so first-time users have to trust running an execution-policy override. Being that aggressive on a work laptop can remove features IT expects to be present.
Pricing: Free and open-source (MIT).
Platforms: Windows 11 (also usable on Windows 10).
Download: Win11Debloat on GitHub
Bottom line: The right first-boot tool on a fresh Windows 11 install, especially if you want AI features and preinstalled Store apps gone in one pass.
6. simplewall: best per-process outbound firewall
simplewall by Henry++ hooks directly into the Windows Filtering Platform (the same low-level API Microsoft’s own firewall uses) and gives you a clean interface for allowing or blocking every process that tries to reach the internet. It ships with an internal blocklist specifically for Microsoft telemetry endpoints, supports WSL, and includes packet logging so you can see what an app tried to send. Portable build is under 1 MB.
Where it falls short: Requires administrator rights. If you approve prompts too quickly during the initial “learn” phase, you can end up whitelisting the very telemetry you meant to block.
Pricing: Free and open-source (GPL-3.0).
Platforms: Windows 7 SP1, 8.1, 10, 11.
Download: simplewall on GitHub
Bottom line: The pick when you want a real outbound firewall that stops Microsoft services process-by-process instead of via hosts file tricks.
7. Portmaster: best full network-privacy suite
Portmaster by Safing is the most ambitious tool on this list. It combines an application firewall, encrypted DNS (DNS-over-HTTPS and DNS-over-TLS), automatic tracker and malware blocklists, and per-app privacy rules into a single dashboard. Everything runs locally on your machine, and you can see which processes are talking to which domains in real time. The paid SPN add-on layers an onion-routing VPN on top, but every feature you need for telemetry blocking is in the free tier.
Where it falls short: Heavier than the other tools on this list (installs a system service and kernel driver). First-week setup involves teaching it what your normal apps look like, which takes a few evenings.
Pricing: Free and open-source (GPL-3.0). SPN VPN is a paid add-on.
Platforms: Windows 10, Windows 11 (Linux build also available).
Download: Portmaster from safing.io
Bottom line: The pick when you want one tool that handles telemetry, DNS, and per-app network rules in a modern interface.
How to pick the right one
Most users end up with two tools, not one, because settings blockers and network blockers cover different halves of the problem.
- If you have five minutes and want the biggest single improvement, install O&O ShutUp10++, apply the recommended profile, and re-run it after every Windows feature update. That alone closes most of what the XDA piece was worried about.
- If you want to understand every toggle you flip, use W10Privacy or Privatezilla instead. Both surface the underlying registry keys and let you save a profile.
- If you are setting up a fresh Windows 11 install, run Win11Debloat first, then layer a settings tool on top for anything the script does not cover.
- If your concern is what Windows sends after the toggles are flipped, add a network-layer tool. WindowsSpyBlocker is the low-friction pick, simplewall is the granular one, and Portmaster is the modern all-in-one.
- If you want a single install to do everything, Portmaster is closest to that. It costs more in RAM and setup time than the others, but a first-time user gets a real dashboard and encrypted DNS on day one.
Whichever you pick, keep the installer around: Windows updates reset settings often enough that you will want to re-apply your privacy profile a few times a year.
FAQ
Does Windows really send typing data to Microsoft?
Yes. Both Windows 10 and Windows 11 collect handwriting and typing samples for personalization by default. The XDA-reported toggle sits under Settings, Privacy & security, Inking and typing personalization, and turning it off stops that specific stream. Diagnostics, activity history, and tailored experiences are separate switches, which is why one toggle is not enough.
Can I stop all Windows telemetry?
Not completely on Home or Pro editions. Even with every switch flipped and Microsoft endpoints blocked at the firewall, a small amount of “Required” diagnostic data still flows on non-Enterprise SKUs. The tools on this list reduce the volume by 90% or more, but the last few percent require an Enterprise-level Diagnostic Data setting of “Security.”
Is O&O ShutUp10++ safe to use?
It is one of the most widely used Windows privacy tools, published by O&O Software GmbH in Berlin since 2015. It creates a system restore point before applying changes and every tweak is reversible from the same interface. Read the recommended profile before applying if you rely on features like location or Cortana.
Will these tools break Windows Update?
Settings-only tools (ShutUp10, W10Privacy, Privatezilla, Win11Debloat) do not affect Windows Update. Network-layer tools can, if you apply an aggressive ruleset that blocks Microsoft’s update infrastructure. WindowsSpyBlocker separates telemetry endpoints from update endpoints for exactly this reason. If you use simplewall or Portmaster, allow the “Windows Update” and “Delivery Optimization” processes explicitly.
Do I need all seven of these?
No. A common pairing is one settings tool (ShutUp10 or W10Privacy) plus one network tool (simplewall or Portmaster). That covers both what Windows tries to send and what actually leaves your machine. Everything else on this list is a specialization on top of those two roles.
