Your browser is leaking
PhishClean stops it.

No - and it can't, by design. Every detection signal runs inside your browser tab. Your passwords, URLs, and page content never leave your machine for detection. We only collect the account and billing information needed to activate and manage your subscription: your install ID, account email, license state, and extension version.

It checks page code locally in your browser for exposed secret patterns that should not be publicly visible — things like AWS access keys (they start with AKIA), live Stripe keys (sk_live_), GitHub personal access tokens, Slack webhooks, Twilio and SendGrid keys, and RSA/PEM private keys. Test keys and common documentation examples are filtered out to reduce false positives. More detail on the Secret Leak Scanner page.

Protection starts the moment you install, with no account. Every signal runs free for 15 days - including secret scanning, JWT detection, HTTPS downgrade alerts, iframe analysis and auth header monitoring. When the trial ends, three signals keep running permanently - blocking of reported phishing sites, hover-to-check link safety, and a warning when a login form posts your password to a different domain - and the other 17 pause until you subscribe.

No. Protection runs from the moment you install, with no account and no card. We ask for an email once during the trial, so your plan follows you to another browser and survives a reinstall - you can decline and keep using it. An account is only required to subscribe.

We haven't seen it. PhishClean runs its checks once when a page finishes loading - it's a quick pass through the DOM, not a persistent background process. There are no network requests involved in detection (everything is local), so there's nothing to add latency. On a typical page it finishes in low single-digit milliseconds.

No. We maintain a built-in list of 60+ trusted domains - Google, GitHub, Amazon, Microsoft, major banks, payment processors, identity providers - and those skip detection entirely. You can also add your own domains to the whitelist if you use internal tools or staging environments that you trust.

PhishClean is available on the Chrome Web Store, Firefox Add-ons, and Edge Add-ons. Any Chromium-based browser - Brave, Vivaldi, Arc - can also install it from the Chrome Web Store.

Google Safe Browsing, which is built into Chrome and Firefox, checks each address against a list of sites already reported as dangerous. A phishing page set up this morning isn't on that list yet. PhishClean doesn't rely on a list: it reads the page you're on and checks what it does, such as a login form that sends your password to a different domain. The two work well together. See the full comparison.

Yes. Many phishing pages are online for less than a day, so they disappear before blocklists catch up. PhishClean doesn't need to have seen a site before. It looks for warning signs in the page itself, such as a lookalike domain, a login form that posts to another site, or a page copying a brand it doesn't belong to.

It shows a warning over the page with a risk score and the reasons it was flagged. You can go back, ignore it once, or trust the domain if you know it's safe. PhishClean warns rather than blocks, so the decision is always yours. If you already entered a password or card number, follow our recovery guide.

To check a page, PhishClean has to be able to look at it, and phishing can appear on any site, so your browser shows this standard permission. The checks run on your device: the pages you visit and what you type are not sent to us for detection. The source code is public if you want to verify it.

All checks are free for the first 15 days, with no card needed. After that it's $9 a month or $59 a year. In India, prices are in rupees. If you don't subscribe, three checks stay free for good: blocking of reported phishing sites, hover-to-check link safety, and the warning when a login form sends your password to another domain.

Yes. Ad blockers filter network requests, and most antivirus browser extensions check sites against a reputation list. PhishClean checks what the page itself is doing, so it catches different things and runs alongside them without conflict. See how it compares with other security extensions.

If you only opened the page, close it and don't enter anything. If you typed a password, change it on the real site and anywhere you reuse it, then turn on two-factor authentication. If you entered card or bank details, call your bank straight away. Our step-by-step guide covers each case.

PhishClean is made for desktop browsers: Chrome, Firefox, Edge, and Chromium-based browsers such as Brave. Most phone browsers don't support extensions, so for now it's a desktop tool.

Yes. The extension's code is public on GitHub, so anyone can check what it does and confirm that detection runs locally.

If something is not working right, reach out to support@phishclean.com and we will help. Refund handling depends on the payment status and issue details, so contact us and we will review it quickly.