Check whether an email is phishing before you click anything in it.
Paste a message or open an .eml file. It reads the SPF, DKIM and DMARC results, where each link really goes, lookalike domains and pressure language, then explains its verdict.
The app itself, running inside this page. Anything you do here is saved in your browser.
Ask it to do things
Press Ctrl+K in the app (Cmd+K on a Mac) and describe what you want. The model chooses from the app's own functions, runs them in order and tells you what changed. Some examples:
| Is this one safe to click? | Scans the pasted email and explains the verdict. |
| Always trust mail from my bank, example-bank.com | Adds the domain to your trusted list. |
| Give me a harder practice email | Opens the training game with a new message. |
Instructions you save in the same box, such as "keep it short" or "I'm a beginner", are added to every AI request the app makes.
Features
- Raw header parsing
- With folded-line support; SPF / DKIM / DMARC badge readout.
- Sender checks
- Reply-To / Return-Path mismatch, display-name brand spoofing, free-webmail 'executives'.
- Link extraction
- From HTML anchors, Markdown and bare URLs, with per-link flags.
- Lookalike detection
- Levenshtein + homoglyph normalization against a brand list; brand-in-subdomain trick.
- Social-engineering lexicon
- Urgency, credentials, money, threats, generic greetings) with in-body highlighting.
- Transparent weighted scoring
- So every point is explained.
- AI second opinion
- Verdict, confidence, reasons, safe next steps.
- Headers page
- Received-chain delivery path with per-hop delays, an SPF/DKIM/DMARC explainer, identity fields (Reply-To, Return-Path, Message-ID) and the full header table.
- URL inspector page
- Colour-coded URL anatomy showing the domain that actually owns the site, punycode/IDN decoding, query parameters, hidden redirect targets and URL-level red flags.
- Homograph detection
- An RFC 3492 punycode decoder plus a Cyrillic/Greek confusables skeleton catches domains like аpple.com.
Runs in your browser
Header parsing, link extraction, domain analysis, lexicon matching, scoring, highlighting. None of this needs a network connection or a model.
Uses a language model for
Analyst review that weighs the deterministic signals against tone and plausibility.
Notes
- Cost
- Free. Each account has a daily allowance of AI requests.
- Your data
- What you make stays in this browser on this device. Your account is only used for signing in and for the built-in AI. You can export a backup or clear everything from Settings.
- AI access
- Signed-in users get the built-in AI with nothing to set up. You can also use your own Groq or OpenRouter key under Settings.
- Source
- The code and tests are on GitHub under the MIT license. The tests also run in your browser.