ShoutPhish

Phishing checks for Gmail that explain every point of the score. Runs in your browser, with no network requests by default.

ShoutPhish checks the email you open in Gmail for signs of phishing, scores it from 0 to 100, and explains every point of that score in plain words, with the evidence so you can check it yourself. WHAT IT NOTICES • Sender names that claim a company the address does not belong to, and addresses one letter away from a real one • Links whose text says one thing while the destination is somewhere else • A reply in a conversation from a lookalike of someone already in it • Requests for codes, passwords, payments or gift cards, and urgent pressure to act • Dangerous or disguised attachments, judged by file name only • Hidden text and other tricks used to get past filters QUIET ON ORDINARY MAIL Genuine messages stay Low Risk, and the badge can stay hidden until something is worth a look. When ShoutPhish cannot read a message properly, it says "Not checked" instead of pretending it is safe. YOUR MAIL STAYS ON YOUR COMPUTER • Every check runs inside your browser. Out of the box, ShoutPhish makes no network requests at all. • No account, no analytics, no advertising, no tracking. There is no ShoutPhish server. • Message content is never saved. Only your settings and the senders you choose to trust are stored. • Links, images and attachments in a message are never opened. • Two permissions: access to Gmail, and storage for your settings. OPTIONAL AI You can add a plain-language reading from Chrome's built-in AI, which runs on your computer, or from an AI server you run yourself, such as Ollama. Both are off until you turn them on. The AI can add at most 15 of the 100 points and can never outvote the checks. OPEN SOURCE The source code, the privacy policy, and a full account of what is read and why are public: https://github.com/amaltaas-studio-llc/ShoutPhish ShoutPhish is not affiliated with Google. It is a second opinion, not a guarantee: no checker catches every phishing message.