Email Scam Checker: Quishing & AI Phishing Detection

On-device AI email scam checker that detects phishing, quishing & QR code scams in your inbox. 100% private, no data collection.

An email scam checker that runs entirely on your device, giving you real-time phishing protection in your inbox before you click. Every message is analyzed inside your browser - your email is never uploaded anywhere. 🛡️ What you see Open any email and it is scanned automatically. A colored badge appears on the message: green for safe, yellow for suspicious, red for scam. Click the badge to see exactly what raised the flag, with the matching text highlighted. There is no separate phishing email checker to open and no link to paste - the check happens on the message where it already sits. The scan looks for the patterns phishing emails depend on: a sender whose display name says one company while the address says another, lookalike domains built from Cyrillic characters or typosquatted spellings, links whose visible text points somewhere other than the real destination, shortener and redirect chains, urgency and manipulation language, generic greetings, dangerous attachments, and hidden content. It also flags credential requests, invoice and wire-transfer fraud, and government-impersonation scams. 🔍 QR code phishing (quishing) QR code phishing, also called quishing, hides in email bodies, PDFs, and image attachments, where a link scan cannot see them. We read the QR code and check the destination it points to, so a code leading to a credential-harvesting page is flagged before you ever open your camera. 🤖 AI Deep Scan For a second opinion, turn on the optional AI model. It is a DistilBERT phishing detector that runs through WebAssembly entirely on your device - about 67 MB, downloaded once, then working offline. It returns its own verdict, a confidence figure, and its reasoning. You can run the rules and the model together and see where they agree. 🔐 Anti-phishing code verification Proton Mail, Coinbase, Gate, and Binance let you set a personal security phrase that appears in every genuine email they send. Add yours once and we verify it on arrival. A message claiming to be from your exchange with a missing or mismatched code is treated as critical, not as a minor warning. 📉 Fewer false alarms We remember which sender domains you actually hear from. A domain you have received mail from before counts as a mild vote of confidence and lowers the score. A domain you have never received mail from gets a caution instead - a useful signal against business email compromise and spoofing, where an attacker writes from an address with no history behind it. We run 28 heuristic checks on each message, and positive signals like unsubscribe links and physical addresses reduce the score. A legitimate newsletter is not treated as a threat just because it asks you to click something. 🔒 Privacy No email content, subject line, or sender address is ever uploaded. No account, no server-side analysis, no logging of your mail. Only anonymous aggregate counts are stored. One exception, so the claim stays precise: to check whether a link points to a freshly registered domain, we send the domain name alone to the public registry that publishes registration dates. That is a bare domain - never your email, never the full link, never which message it came from. It works only for domain endings whose registry publishes a date, and a domain we cannot check is never flagged for it. ✅ Ready out of the box Install it and it starts working. No signup, no setup, nothing to configure. Works in every major webmail service, right in the inbox you already use. 🧾 Common questions ❓ Is my email sent anywhere? 💡 No. Messages are analyzed inside your browser, and no email content, subject line, or sender address is uploaded. ❓ Which browsers and email services does it work with? 💡 It runs in Chrome, Edge, Firefox, and most Chromium-based browsers. For email, it works in every major webmail service - no separate app and nothing to forward. ❓ What is an anti-phishing code? 💡 A personal phrase that services like Proton Mail, Coinbase, Gate, and Binance include in every genuine email they send. If a message claims to be from one of them and your code is missing or wrong, that is treated as a critical signal. ❓ Does the AI model need an internet connection? 💡 Only for the first download. After that it runs offline. ❓ What if a legitimate email gets flagged? 💡 The badge shows which patterns raised the score and why, so you can judge the message yourself. Genuine signals like unsubscribe links and physical addresses lower the score, which keeps ordinary newsletters from being treated as threats. ❓ Do I need to configure anything before it works? 💡 No. It starts scanning as soon as it is installed. Anti-phishing codes are the one optional step, and only if you use a service that sends them. ❓ Is this email legit? 💡 Open the message and read the badge: green means no significant warning signs, yellow means something looked off, red means the message matches known scam patterns. The findings list shows what raised the score, so you can judge it yourself rather than trusting a verdict blindly. ❓ How do I report a phishing email? 💡 Use your provider's "Report phishing" option, or forward the message to the abuse address the impersonated company publishes. Reporting does not undo a click, so if you already clicked, change that account's password first. ❓ How do I stop phishing emails? 💡 The warning has to arrive before you act, which is why the extension flags each message as you open it. Beyond that, turning on two-factor authentication limits the damage when a password does get captured.