PhishGuard

Fake login pages are designed to be indistinguishable from the real thing. PhishGuard checks each site you open and tells you when something is wrong — before you type a password.

HOW IT WORKS

PhishGuard looks at several independent things about a site and weighs them together. No single check decides the answer.

• Registration date — sites set up days or weeks ago are treated with suspicion, because disposable domains are the backbone of phishing
• Certificates — whether your device actually trusts the site's security certificate, not merely whether one exists
• Impersonation — whether a page presents itself as a bank, wallet or well-known service while being served from a domain that company does not own
• Page structure — password fields, forms that send your details somewhere else, redirects away from the site you opened
• Reputation — whether the site is one the world visits, or one nothing has heard of
• Shared hosting — pages published on site builders and free hosting are judged on their own merits, not on the reputation of the platform hosting them

CRYPTO WALLET PROTECTION

No legitimate wallet ever asks for your seed phrase in a web page. PhishGuard flags pages that ask for recovery phrases, mnemonics or private keys, and pages pretending to be a wallet they are not.

ON-DEVICE ANALYSIS

On devices that support Apple Intelligence, PhishGuard also asks Apple's on-device model to describe what a page is asking of you — whether it wants a password or a recovery phrase, whether it claims you must act urgently, and which company it says it is. This runs entirely on your device and makes no network request. It is also the part that understands pages written in languages other than English.

On devices without Apple Intelligence, every other check works exactly the same.

WHAT YOU SEE

A coloured badge on the toolbar for every page. A warning in the page itself when something looks wrong. Tap the extension for the specific reasons behind any verdict, in plain language, along with how many of the checks completed — so you can tell a thorough result from a partial one.

PRIVACY

PhishGuard has no servers, no accounts and no analytics. Nothing is collected about you or your browsing.

To check a site, PhishGuard sends the domain name — never the page address or its contents — to public services that publish domain registration dates and site popularity. Page content is read from the page already open in your browser and never leaves your device.

LANGUAGES

English, Spanish, French, German, Chinese (Simplified), Japanese and Hindi.

FREE

No subscription, no in-app purchases, no advertising.

---

PhishGuard helps you spot sites that are trying to deceive you, but no tool catches everything. It complements your own judgement rather than replacing it, and it does not replace the protections already built into Safari and iOS. Always take care when entering sensitive information online.