Media
3 items
Description
Hover a link to see where it really goes. Decoy catches look-alike domains, homographs and trackers, and explains each one. π Links lie. hxxps://secure-Π°pple.com.login-verify.tk/ reads as Apple. It isn't. Every address on the web is either a decoy or it isn't β and right now you only find out which after you've typed your password. Decoy reads the link first. Rest your pointer on anything and a small card appears: a verdict, the destination taken apart, and the reason in plain English. Not "suspicious". This: "The 0 stands in for the letter o. Microsoft really lives at microsoft.com, not micros0ft-secure.top." ββββββββββββββββββββββββ β¨ WHAT IT DOES π±οΈ Hover verdict β Judged the moment your pointer lands. A decoy raises the card on its own; for anything else, rest and press D. π Look-alike detection β 224 bundled brands. Catches micros0ft, amaz0n, paypa1, secure-login-amazon, and Cyrillic Π° pretending to be a. π§ Confirm wall (optional) β A link that trips a rule doesn't navigate until you say so. Nothing is ever blocked β you always choose. π Page audit β Alt+Shift+A lists every link on the page, worst first. π¨ Link tints (optional) β Suspicious links get outlined in the page itself. π₯ Pasted URL flags (optional) β Paste a link anywhere and Decoy judges it on the spot. βοΈ Copy clean link β Right-click to strip utm_*, fbclid, gclid and friends. π§ Every rule switchable β Read them in plain words. Turn any off. β Your own watchlist β Teach it your bank, your SaaS, your internal tools. ββββββββββββββββββββββββ π£ WHY THIS EXISTS We read a URL like a sentence β the shape, the colour, the logo above it β and stop somewhere around the middle. That's exactly where a phishing link is built to be read: β’ a brand in a subdomain, where the real domain hides β’ l β 1, o β 0 β one character swapped β’ letters from another alphabet that render identically β’ pressure words: verify, suspended, unlock β’ a second address hidden in the path None obvious at a glance. All trivial to check. That gap is the whole product. ββββββββββββββββββββββββ π PRIVACY No servers. No accounts. No analytics. β’ Zero network requests by default β works with your connection unplugged β’ The verdict is computed in the tab, in about a millisecond β’ No telemetry, no crash reports, no "anonymous" IDs β there is no endpoint in this extension β’ Everything stays local in chrome.storage.local. Export it as one file, or delete it all with one button. One optional request, off by default: turn on Live destination preview and Decoy fetches the page you're pointing at β straight from your browser to that host, no cookies, no referrer. Only the title, description and favicon are kept. Off any time. ββββββββββββββββββββββββ βοΈ HONEST ABOUT BEING A HEURISTIC A Clean verdict means nothing matched a rule β not that a site is safe. Decoy is a second pair of eyes, not a security product. It complements a password manager and MFA; it doesn't replace them. If a link passes every rule and still feels wrong, trust your gut. ββββββββββββββββββββββββ π FREE. FOREVER. EVERYTHING INCLUDED. No accounts, no limits, no Pro nag, nothing disabled on purpose. Open source. MIT licensed. Zero dependencies. Built by Sneg HQ β https://sneg.dev