Whisper Guard by Whisper Security

The moment you install it, the toolbar mark answers "is THIS site safe?" on every page you visit, with no account needed: green for no known threat, amber for suspicious, a red stop plate reserved for evidenced-malicious sites, and an honest UNKNOWN for the internet's long tail. Click the mark for who runs the site and where it lives, how old the domain is, the threat feeds it is listed in, and a look-alike neighborhood confirmed against the graph.

An on-device detector also checks every site against 800+ heavily phished brands: homoglyph tricks (paypa1.com, Cyrillic lookalikes), swapped endings (paypal.tk), hyphen squats (face-book.com), fake subdomains (paypal.com.evil.example) and combo squats (paypal-secure-login.com). One tap takes you to the real site. Right-click any link to vet it before you open it.

The "This browser" dashboard shows where this browser goes, enriched through the graph: which companies answer, in which countries, on which networks, and what is flagged. No account needed.

Sign in free (one tap, no API key to handle) to unlock your whole fleet: every device and agent on your Whisper account in one view, per-endpoint drill-downs with an explainable identity-health score, and the option to route this browser itself through Whisper egress so it becomes a first-class endpoint with its own routable identity.

Privacy is the product:
- Only a site's NAME is ever checked. Never the page, the path, what you type, or your history. Your on-device destination list never leaves the device.
- The bare hostname goes to exactly one endpoint to answer the safety check and is not retained to build a browsing profile. One switch turns the live check off, after which only the on-device detector runs and nothing leaves at all.
- No telemetry, no analytics, no sync. Open source (MIT).

Optional Active Shield adds a full-page stop before known credential-phishing pages and a caution when a password field gains focus on a flagged site. It asks for the browser's own
on-page permission only when you turn it on, and declining it keeps everything else working.

If Whisper is unreachable the extension fails open: browsing is never blocked and the on-device protection keeps running.