# Free phishing protection without giving up your data: what each tool sends

> Free phishing protection often costs some browsing data. What Chrome, Netcraft, Malwarebytes, Bitdefender and PhishClean send, from their own documents.

Canonical: https://www.phishclean.com/blog/free-phishing-protection-without-giving-up-your-data
Last updated: 2026-11-05

November 5, 2026 - 5 min read

By PhishClean Research Team

To check a site, a tool either asks a server or decides on your device. We read what the popular free options say they send, so you can pick what you're comfortable with.

Every so often a post appears promising phishing protection for free and without giving up your data, and the comments fill up with the same question: how do you check a website without telling anyone which website it is?

It's a fair question. A phishing check needs the address you're visiting. So either the check happens on your device, against a list or a set of rules it already has, or some part of the address goes to a server. Good tools can do the second part quite privately. It's just worth knowing which you're getting.

## What the popular options say they send

We make PhishClean, so read this with that in mind. Each row below is based on the vendor's own documents, not on our guess. Where a document doesn't say, neither do we. These policies change, so check the current version before relying on them.

| Tool | Price | What it says is sent |
| --- | --- | --- |
| **Chrome Safe Browsing, Standard** | Built in | Checks a safe list on your device first. If the site isn't on it, Chrome sends an obfuscated part of the URL through a privacy server that hides your IP address from Google. Fuller URLs and bits of page content go only when a site behaves suspiciously. |
| **Chrome Safe Browsing, Enhanced** | Built in | The URLs you visit, a small sample of page content, downloads, extension activity and system information. Temporarily linked to your Google Account if you're signed in. Stronger protection, more data. |
| **Netcraft Extension** | Free | "Web sites (not URLs) visited when browsing the web." Also the full URL if a site loads malicious JavaScript. |
| **Malwarebytes Browser Guard** | Free | The URL and block count of blocked pages, any domains you exclude, browser and OS details, a broad location, and anonymized browsing statistics. There's an opt-out toggle on the support screen, and its policy says full browsing histories aren't retained. |
| **Bitdefender Web Sage** (formerly TrafficLight) | Free with a Bitdefender account; Premium with paid plans | Bitdefender says it reads each page you open, and its store listing names website content among the data it handles. Its product page doesn't say how much of that is processed in the browser and how much on its servers. |
| **PhishClean** | 5 checks free; all 27 at $9/month or $59/year | Detection runs on your device, and no URLs, page content or browsing history are sent to us. Zero browsing data collected. Ever. It does send an install ID for your license and downloads its phishing list. |

## "We don't collect your data" can mean several things

Three questions separate a real claim from marketing:

1. **Where does the decision happen?** On your device, nothing about the page needs to leave. On a server, something does, though it might be obfuscated.
2. **What's in the telemetry?** A tool can do its check locally and still report what it blocked. Blocked-page reporting is reasonable, since it helps catch false alarms, but it's still data.
3. **Can you verify it?** Open source code and a published list of network requests beat a sentence in a privacy policy. PhishClean's extension source is public, and [the README](https://github.com/chidhu07/phishclean-extension) lists every request it can make, including the ones that aren't about browsing: the install ID, a five-character password hash prefix for the Have I Been Pwned check, and on paid plans a repo's name to its code host.

## The trade-off nobody puts on the box

Sending data isn't simply bad. A server knows about threats that appeared minutes ago, and it can run heavier analysis than your laptop can. Google calls Enhanced the strongest level of protection it offers, and that's a reasonable claim. If you don't mind Google seeing your URLs, because it already sees your searches and email, Enhanced is a strong free choice.

A device-only check has its own limits. Its list is only as fresh as its last download (PhishClean's updates twice a day), and it can't run a heavy model on each page. We publish how our page checks perform, including when the sample is thin, on our [detection numbers page](https://www.phishclean.com/transparency).

## What free really gets you

For most people, this is a sensible free setup:

- Keep your browser's built-in protection on. Whichever level you pick, it's far better than turning it off.
- Use a free password manager that fills by exact domain. It's phishing protection that sends nothing about your browsing to anyone.
- Add a free passkey to your main email account.
- Add one extension, if you want. More than one security extension doesn't double your protection, and each one you install is another that can read your pages. See [can an extension steal my login session?](https://www.phishclean.com/blog/can-a-browser-extension-steal-my-login-session)

## What PhishClean gives you without paying

After the 7-day trial of all 27 checks, five stay free for good: blocking about 380,000 reported phishing sites, link-safety checks on hover, the check on where a password field really sends your password, and warnings on fake CAPTCHA and fake job-interview "paste this command" pages. Red badges on reported links in search results, webmail and chat apps stay free too. The rest, such as lookalike warnings and Paste Guard, are paid. If you want everything free with no paid tier at all, Netcraft and Malwarebytes Browser Guard are honest alternatives, and our [roundup](https://www.phishclean.com/compare/best-anti-phishing-browser-extensions) compares them.

## Frequently asked questions

### Is there free phishing protection that doesn't collect data?

Some checks can run entirely on your device. PhishClean's free tier does its detection locally and sends no browsing data to us. A password manager and passkeys also protect you without sharing your browsing.

### Does Chrome Safe Browsing send my URLs to Google?

In Standard mode, Chrome checks a list on your device first, then sends an obfuscated part of the URL through a privacy server that hides your IP address. Enhanced mode sends the URLs you visit and more. Google documents both.

### Is Enhanced Safe Browsing worth turning on?

If you're comfortable with Google seeing your URLs, it's a strong free upgrade. If you'd rather not share that, keep Standard and add a device-based check. Don't turn Safe Browsing off.

### How can I check a privacy claim myself?

Read the tool's privacy policy, look for published source code and a list of network requests, or watch the extension's traffic in your browser's developer tools.

[Best anti-phishing extensionsNine tools compared, including competitors.](https://www.phishclean.com/compare/best-anti-phishing-browser-extensions) [Detection numbersHow our page checks perform, measured daily.](https://www.phishclean.com/transparency) [Can an extension steal my session?Why fewer extensions is safer.](https://www.phishclean.com/blog/can-a-browser-extension-steal-my-login-session) [How to protect yourself from phishingThe habits that hold up when you're fooled.](https://www.phishclean.com/blog/how-to-protect-yourself-from-phishing)

## Sources

- [Google: How Chrome Safe Browsing keeps your browsing data private](https://support.google.com/chrome/answer/13844634)
- [Google: Choose your Safe Browsing protection level](https://support.google.com/chrome/answer/9890866)
- [Google Online Security Blog: Enhanced Protection](https://security.googleblog.com/2022/12/enhanced-protection-strongest-level-of.html)
- [Netcraft Extension privacy policy](https://addons.mozilla.org/en-US/firefox/addon/netcraft-toolbar/privacy/)
- [Malwarebytes privacy policy](https://www.malwarebytes.com/legal/privacy)
- [Malwarebytes: Manage Browser Guard from the Support screen](https://support.malwarebytes.com/hc/en-us/articles/14875038019219--Manage-Browser-Guard-from-the-Support-screen)
- [Bitdefender: Web Sage](https://www.bitdefender.com/en-us/consumer/web-sage)
- [Bitdefender Web Sage on the Chrome Web Store](https://chromewebstore.google.com/detail/trafficlight/cfnpidifppmenkapgihekkeednfoenal)
- [PhishClean extension source and network requests](https://github.com/chidhu07/phishclean-extension)

## We never see what you browse

PhishClean's detection runs on your device, and its source is public so you can check. Five checks stay free for good.

[Install PhishClean free](https://www.phishclean.com/#install)

Last updated: 5 November 2026