BaitWatch

Catches scam and phishing messages as you read them. Runs entirely on your device — nothing is sent anywhere by default.

BaitWatch reads the message you are looking at and tells you, in plain language, whether someone is trying to scam you — and what they are actually after. It runs on your computer. The whole detector ships inside the extension: a rule engine, a URL and domain checker, and a small statistical model. There is no server in this project, no account, and no sign-up. By default nothing you read is sent anywhere. WHAT IT CATCHES Requests for one-time passcodes, passwords, PINs and card details. Payment pressure — gift cards, crypto transfers, UPI collect-requests, redirected invoices. Threats of arrest or account closure. Demands for secrecy. Requests to install remote-access software. Links whose visible text disagrees with where they go, lookalike domains, and addresses spelled with characters from another alphabet so that "рaypal" reads as "paypal". WHERE IT WORKS Gmail, WhatsApp Web and Telegram Web are read automatically as you open messages; on Gmail it also reads the sender's address so you can block them in one click. On any other site there is a general scan that looks at anything shaped like a message. You can turn any of these off in Settings. Two things work anywhere: select text on a page, right-click, and choose "Check this text for scams"; or open the extension and press "Scan this entire page", which judges the page's text, every link on it, the site's own address, and whether it is asking for a password or a one-time code while claiming to be a company that does not own the domain. WHAT IT TELLS YOU A verdict — nothing suspicious, treat with caution, or almost certainly a scam — a risk score, the specific things in the message that drove it, and one concrete next step. Not a red border and a warning symbol: sentences a non-technical person can act on. YOUR DATA Verdict history, blocked and safe senders, and your settings are stored in this browser only. Nothing is uploaded. You can export your history as CSV or delete everything from Settings, and uninstalling removes all of it. OPTIONAL: A SECOND OPINION FROM CLAUDE Off unless you turn it on. If you paste your own Anthropic API key into Settings, messages the on-device check cannot settle confidently are sent to Anthropic's API for a reasoned second opinion. That is the only feature that sends the text you are reading, it is billed to your own key, and the extension does nothing at all with it if you leave the setting off. See the privacy policy for exactly what is sent. OPTIONAL: LINK CHECKS Two more settings, both off until you turn them on and each asking Chrome for permission first: expanding shortened links (the extension requests the short link, from your connection, to see where it leads) and checking links against abuse.ch's public URLhaus list (a plain download; no link from your messages is sent). Details are in the privacy policy. TESTED AGAINST A BENCHMARK Against a 3,703-message benchmark of 1,839 scams and 1,864 ordinary messages, the on-device layers alone raise a false alarm on 0.48% of legitimate messages and call a legitimate message "almost certainly a scam" 0.16% of the time. On the 415 curated messages representing the tactics it is built for, it misses 0.24%. On Hindi and Hinglish scams it misses 0.00% of 270, with false alarms on 1.32% of ordinary Hinglish. These are the project's own published test gates, run on every change; the code and the corpus are on GitHub under the MIT licence. Source: https://github.com/sreekarseera/baitwatch