Savvy Fish spots phishing sites before you hand over your credentials. Right in your browser, 100% local.
Phishing means imitating a legitimate site — your bank, your mailbox, a delivery service — to steal your credentials, passwords or card details.
For example: an email saying “Your account will be suspended” urges you to click. The page looks exactly like the real one… and so does the address, deceptively so:
https://pаypаl.com/signin
Cyrillic “а” characters — identical to the naked eye
https://paypal.com
the real domain
You type your password: it goes straight to the attacker. Savvy Fish intercepts these traps before the page loads.
Catches domains that imitate the real ones:
rncrosoft.com (an “rn” disguised as an “m”),
pаypаl.com (Cyrillic “а” characters)… Deterministic analysis of typos,
homoglyphs and brand impersonation.
A model trained on a very large dataset of real malicious URLs scores every address you visit and recognizes the “shape” of a phishing attempt — even a brand-new one.
Already-confirmed phishing sites are blocked immediately thanks to a regularly updated blocklist, etc.
Your browsing never leaves your device. All three engines run inside the browser: no account, no analysis server, no telemetry. A security tool has no business becoming a spy itself. The code is open source: you can verify it yourself.
Phishing is the 2nd most costly attack vector, behind attacks using compromised credentials.
Free, open source and lightweight. Add it to your browser in one click.
Available now on the Chrome Web Store and Firefox Add-ons.
No. All the analysis runs inside your browser: the addresses you visit never leave your device. Savvy Fish requires no account, no sign-up, and collects no usage statistics.
Depending on the severity, Savvy Fish shows a warning banner on the page or blocks the navigation with an explanation page detailing what raised suspicion. You always stay in control: continue, go back, or trust the site.
No detector is perfect. You can add a site to your trusted list in one click: it will no longer be flagged. That list, too, is stored only on your device.
No. Analyzing an address takes a few milliseconds, and the popular sites you visit go through a fast path. It is imperceptible.
Chrome and Firefox. On Firefox the protection is even stronger: the site's certificate is checked locally on top of the other engines.
Nothing. Savvy Fish is free.
A question, a misclassified site, an idea for improvement? Write to us — a human will reply.
notphished@protonmail.com