Phishing Guard

A Chrome extension, web dashboard and API that protect people while they browse.

Phishing Guard has three parts that work together: a Manifest V3 Chrome extension that checks pages as you browse, a Flask API that does the detection, and a React dashboard for history, whitelists and an admin console. It also includes public tools: a site security checkup and a breach-checked password checker.

The problem

People usually find out a page is a phishing page after they have typed something into it. Phishing Guard warns before a password, card number or one-time code is entered on a risky site.

What I built

Real-time detection: Local heuristics combined with Google Safe Browsing and the OpenPhish community feed.
Favicon impersonation: A perceptual-hash match flags a known brand's icon appearing on an unrelated domain.
Credential-entry protection: A warning before passwords, cards or OTPs are entered on risky sites.
Site security grade (A to F): Headers, TLS and cookie flags, shareable and available without logging in.
Password breach check: Uses Have I Been Pwned's k-anonymity API, so only a hash prefix is ever checked.
Exposed secret scan: Flags leaked keys and tokens in a site's client-side code.
Accounts and admin: Per-user whitelist, blacklist and history, plus an admin console for reviewing reported domains and users.

How it is put together

The extension talks to a Flask API that runs the checks and stores per-user data. The React and Vite dashboard uses the same API for scan history, whitelist and blacklist management, and the public tools. Every environment variable is optional: with none set, detection still runs on local heuristics and OpenPhish.

Current limits

On the free hosting tier the database is not on a persistent disk, so a redeploy clears registered users and history. The project is set up to fix that with a persistent disk when it moves to a paid plan.

Built with

Python, Flask, React, Vite, Chrome Extension (MV3), SQLite

Source on GitHub · Live demo

All projects