HARD

Stops fake sign-in pages, catches your password on the wrong site, pauses big payments and checks every extension you install.

HARD stops the attacks that empty bank accounts: fake sign-in pages, stolen passwords and the phone call that ends with money sent to "a safe account". Fake sign-in pages, stopped before they load - Lookalike addresses: letters from other alphabets, digit swaps, one-letter typos, and brand names on someone else's domain. - 392,000 reported phishing sites, refreshed every 6 hours. - Copied Google, Microsoft, Apple, PayPal and bank sign-in forms on sites those brands don't own. - Suspicious domains registered in the last 60 days. Your password, caught on the wrong site Sign in to Google, Microsoft or Apple once. HARD keeps a salted hash, never the password. If that password is typed on any other site, HARD clears the field and stops the form. Big payments wait a moment On your bank, payment apps and crypto exchanges, a payment over your limit ($2,000 by default), a new payee or a crypto address pauses with the questions scammers hope you won't ask: is someone on the phone telling you to do this? Did they say your money isn't safe? If a remote-control app like AnyDesk or TeamViewer is open, the pause can't be skipped. Every other extension, checked HARD flags known-malicious extensions, sideloaded ones, ones that update from outside the store, and ones that can read your cookies or control the browser. Password-only sign-ins If Google or Microsoft lets you in with only a password, HARD suggests turning on a second step. Private by design HARD checks pages on your computer. It never sends your pages, passwords or what you type anywhere. The only lookup it makes is the age of an already-suspicious domain (rdap.org). With HARD for Mac installed, the Mac app gets the hostname and what HARD stopped, nothing more. Privacy policy: https://hard.fyi/privacy/