New in 1.7.0

• Safety badges on search results: Google, Bing and DuckDuckGo results are marked red for reported phishing sites, amber for lookalikes of well-known brands, and green for well-known sites. You can turn this off in Settings.
• "Click Allow" trap warning: PhishClean warns you on pages that tell you to click Allow to prove you're not a robot or to play a video. Allow would let the site push spam and fake virus alerts to your desktop.
• Fake shop warning: PhishClean warns you on stores that sell brand-name goods at 70–90% off from a website the brand doesn't own.
• For companies: IT teams can now manage PhishClean for staff with an organisation key and company-wide trusted domains.

As always, every check runs on your device. Nothing you search for or visit is sent to us.

Blocks known phishing sites. The extension had no list of reported phishing sites at all, which every competitor has. It now checks against about 378,000 reported sites, rebuilt on every site deploy. The raw source list included real sites like Google Sites and Gravatar, so those are filtered out; none of the world's 1,000 most popular sites are blocked. I made this free: withholding a warning about a known phishing page would hurt the very user it failed. On the free tier, that warning is also where the upgrade offer appears.
Fake virus / tech support scam warning (paid). It flags pages that show a toll-free support number together with typical scam wording. Articles that only quote the scam wording aren't flagged. Scam calls cost victims real money, which makes this an easy reason to pay.
Bug fix: in 1.4.4, PhishClean ran no checks at all on plain http:// sites, because a function it calls at startup doesn't exist on those pages.

Version 1.4.4

• After you subscribe, full protection now turns on within a minute. You no longer need to click Refresh.
• The buttons on the payment confirmation page now work.
• If you've paid but aren't signed in, you can now sign in from Settings so your plan survives a reinstall and works on your other browsers.
• Updates now take effect as soon as they're downloaded.

Version 1.4.2

• After you subscribe, full protection now turns on within a minute. You no longer need to click Refresh.
• The buttons on the payment confirmation page now work: "Return to extension" opens PhishClean's settings, and "Close this tab" closes it.

Version 1.4.1

Fewer false alarms
- Pages that simply link to big brands (Google Fonts, GitHub or LinkedIn in a footer) no longer trigger a warning. Brand borrowing now only counts when the page also asks for something, like a password.
- Checklists that mention UPI or OTP details are no longer mistaken for scam pages.

Fixes
- "Go Back" on a warning now always takes you off the flagged page. If there's no page to go back to, it opens a blank page instead.
- Clicking the PhishClean logo in the popup or weekly report opens phishclean.com.
- Tidier weekly summary in the popup.

Version 1.4.0

New: breached site warnings
When you click into a password field on a site that has had a known data breach, PhishClean shows a short note with when it happened, what leaked, and a reminder not to reuse that password anywhere else. You see it once per site. The breach list is downloaded from Have I Been Pwned and matched on your device, so the site you're on is never sent anywhere. Free for everyone.

New: leaked password check
As you type a password, PhishClean tells you if it has appeared in past data breaches, before you press Sign in. Your password never leaves the page: only the first 5 characters of its SHA-1 hash are sent to Have I Been Pwned (k-anonymity), and the match is made on your device. Included in the 15-day trial and the paid plan.

Fewer false alarms
- Pages that simply link to big brands (Google Fonts, GitHub or LinkedIn in a footer) no longer trigger a warning. Brand borrowing now only counts when the page also asks for something, like a password.
- Checklists that mention UPI or OTP details are no longer mistaken for scam pages.

Fixes
- "Go Back" on a warning now always takes you off the flagged page. If there's no page to go back to, it opens a blank page instead.
- Tidier weekly summary in the popup.

Privacy: the two Have I Been Pwned requests above go straight from your browser to Have I Been Pwned, never through us, and neither includes a URL, site name or your password. Details: https://www.phishclean.com/privacy

PhishClean 1.3.0: see your protection working

The toolbar icon now shows how many pages PhishClean checked today. It's green on a normal day and red on a day something was blocked. Only the count is stored, on your device.
A weekly safety report of pages checked and threats caught, built from local data and never uploaded.
"Clicked a bad link?": a step-by-step guide for what to do if you already typed a password or card number, linked from the popup and every warning.
Detects common Indian scam pages (fake traffic fines, KYC updates, electricity, parcel, tax refund, FASTag and reward-point pages that ask for card, UPI or OTP details), in English and Hindi. Indian banks are added to lookalike-domain detection.
Rupee pricing in India: ₹149/month or ₹999/year.
A cleaner settings page and popup, and a fix for the "Contact support" link.
All detection still runs locally. Nothing about the pages you visit leaves your browser.

What's new in 1.2.0

• Subscribe without creating an account. When your 15-day trial ends, the Upgrade button now takes you straight to checkout. An account is optional — add one only if you want your plan to follow you to another browser.
• You'll be told when your trial ends. PhishClean now opens its settings page once, on the day the trial expires, so you can decide what to do. It never asks again.
• Two checks stay free forever. Link-safety hover checks and the warning when a login form sends your password to a different domain keep running after the trial, with or without a plan.
• Fixed: users who paid and then created an account could briefly be shown as "Free". Paid status now carries over to the account correctly.

As always, all detection runs locally in your browser. No page content, URLs, or browsing history are ever sent anywhere.

Log Out now fully disconnects your account from this install; protection pauses until you sign in again.
New "Forgot password?" link on the sign-in screen — reset your password at phishclean.com/reset-password.
Fixed: after logging out, the settings page could show no way to sign back in.

PhishClean 1.1.8

New
• Password-in-URL detection: PhishClean now warns when a page URL — or a
link you hover — contains a raw login password (e.g. ?password=…), which
leaks credentials into browser history, server logs and referrer headers.

Improved
• Refreshed popup and options UI for a cleaner, more readable status view.
• PDF security report: long detection reasons now wrap fully instead of
being cut off, text size stays consistent across pages, and the threat
table header repeats on every page.

All detection continues to run 100% locally on your device. No browsing
data is ever sent to any server.

PhishClean 1.1.7

New
• Password-in-URL detection: PhishClean now warns when a page URL — or a
link you hover — contains a raw login password (e.g. ?password=…), which
leaks credentials into browser history, server logs and referrer headers.

Improved
• Refreshed popup and options UI for a cleaner, more readable status view.

All detection continues to run 100% locally on your device. No browsing
data is ever sent to any server.

Improved phishing detection and browser privacy analysis. Enhanced security checks for suspicious pages and optimized extension performance. Added refinements to user alerts and overall stability improvements.

Improved payment success flow, automatic post-checkout status refresh, and clearer setup messaging

v1.1.1
• Fixed: Link tooltip no longer shows duplicate indicators on PhishClean demo pages
• Minor internal cleanup for tooltip element detection

v1.1.0 — Link Safety Tooltips

• New: Hover over any link to see a safety indicator — green checkmark for safe links, yellow/red warnings for suspicious ones
• Checks include: punycode domains, IP URLs, text/URL mismatch, HTTPS downgrade, JWT tokens in URLs, suspicious file extensions, excessive subdomains, and shortened URL detection
• All checks run 100% locally — no data sent anywhere

v1.0.2
- Fixed payment verification flow
- Redesigned PDF security reports with clickable header and footer
- Added subscription management (manage/cancel from popup)
- Fixed trial banner showing incorrectly for Pro users
- Added Firefox for Android support