Browser extension — Firefox & Chrome
One character off is a different website.
Phishing Protect watches the address bar for imitations of the sites you name. When a page is wearing your domain's face but isn't your domain, it says so — before you type a password into it.
Free. No account to create. Nothing is sent anywhere.
Digit 0 swapped in for the letter o.
How it works
Three steps, then it stays out of your way.
Name the sites you care about
Add one domain or a dozen — your forum, your bank, your webmail, the shop you run. There's no default list and no site is added for you.
Every page you open gets checked
The extension compares the address of the page against your list. The comparison runs inside your browser, on the URL alone, in well under a millisecond.
Close calls get flagged
If an address resembles one of your domains without matching it, a warning covers the page and names the real domain. Exact matches pass silently.
Detection
Phishing domains are built to survive a glance.
Attackers register addresses that read correctly at speed. Phishing Protect compares character by character instead, so the differences a reader skips over get caught.
Letters transposed, doubled or dropped — yuorboard.com for yourboard.com. Registered on purpose, waiting for a fast typist.
Digits and foreign alphabets that share a shape: yourb0ard.com, or a Cyrillic у standing in for a Latin y.
Extra words, hyphens and dots that keep your name readable inside a longer address: your-board.com, secure-yourboard.com.
Your domain demoted to a subdomain of someone else's: yourboard.account-verify.net. The part that matters is the last two labels, and most people don't read that far.
The same name under another top-level domain — yourboard.co, yourboard.net — when only one of them is yours.
Scope
What it doesn't do.
A security tool that oversells itself teaches people to ignore it. Here is the honest edge of this one.
It doesn't read pages
Only the address is examined. Page content, form fields and anything you type are never inspected, stored or transmitted.
It isn't a blocklist
There's no central list of known-bad sites and no lookup service. A phishing page that resembles nothing on your list will not be flagged.
It doesn't replace 2FA
Two-factor authentication is still your strongest protection on any account. Treat this as an early warning, not a substitute.
It can't stop you
The warning can be dismissed. Phishing Protect informs a decision; it doesn't take the decision away from you.
Install
Add it, name one domain, done.
Setup takes about a minute. The extension asks for permission to read the address of pages you visit, and for local storage to keep your list — nothing else.
Also works in Edge, Brave and other Chromium browsers via the Chrome listing.