EN ES PT

Privacy Comparison

See how SafeMode compares to other security extensions

Minimal Data Collection
We only send anonymous content hashes to verify threats. We never see your URLs or browsing history.
Instant Protection
Hash-based matching means sub-millisecond threat detection.
AI-Powered Analysis
Our AI analyzes phishing pages so you don't have to.

Enterprise-Grade Protection

99.9% Uptime Guarantee
Our infrastructure is designed for maximum reliability. Multiple redundant systems ensure protection is always available when you need it.
Real-Time Threat Database
We analyze thousands of phishing pages daily. Our database is updated continuously, not weekly or monthly like traditional solutions.
Multi-Layer Detection
We use multiple detection methods simultaneously: content signatures, visual similarity, URL patterns, and behavioral analysis for maximum accuracy.
Zero False Positives Design
Every detection is cross-validated by multiple systems before alerting. We prioritize accuracy to never block legitimate sites.

How We Detect Threats

Content Signatures
Fuzzy hashing identifies phishing kits even when URLs change
Visual Similarity
Screenshot comparison catches pixel-perfect clones
URL Analysis
Pattern matching detects suspicious domain structures
Cross Validation
Multiple detection methods cross-validate all findings

Privacy Ranking

Rank Extension Privacy Level Telemetry Data Sent Phishing Detection
1 uBlock Origin Lite* Excellent None None URL blocklist
2 SafeMode Very High None Hash only Content signatures
3 ScamAdviser Medium-High Low Domain only "Domain reputation"
4 Scam Sniffer Medium Medium URLs + Crypto "Crypto firewall"
5 WOT Low High URLs + Behavior "Crowd ratings"
6 Malwarebytes Low High URLs + Telemetry "Signature-based"
7 VirusTotal Very Low Very High DNS + Files "Multi-engine"
8 Guardio Very Low Extreme Everything "AI-based"

* uBlock Origin Lite uses static URL blocklists. Same phishing kit = 1000+ URLs. SafeMode analyzes 5000+ kits/day with AI for real-time content-based detection.

Data Collection Comparison

Data Type SafeMode WOT Guardio Malwarebytes VirusTotal
Current URL ✗ ✓ ✓ ✓ ✓
Browsing History ✗ ✓ ✓ ✗ ✗
Keystrokes ✗ ✗ ✓ ✗ ✗
Page DOM/Content ✗ ✗ ✓ ✗ ✗
DNS Queries ✗ ✗ ✗ ✗ ✓
Downloaded Files ✗ ✗ ✓ ✗ ✓

See What Other Extensions Send to Their Servers

Real code extracted from public Chrome Web Store extensions. No modification, just the truth.

Your Browser
https://mybank.com/login
password: ●●●●●●●●
email: [email protected]
Google ID: 1234567890
Timezone: UTC-5
URL
DOM
INPUT_FOCUS
KB_MESSAGE
Their Server
ext.guard.io/comm
api.mywot.com/v3/query
telemetry.malwarebytes.com
virustotal.com/resolutions
domain-api.scamsniffer.io
Guardio
WOT
Malwarebytes
VirusTotal
Scam Sniffer
// guard.js - Events sent to ext.guard.io/comm
var MessageType = {
    KB_MESSAGE: 1,           // Keyboard events
    KB_INJECTED_MESSAGE: 2,  // Injected keyboard
    INPUT_FOCUS: 11,         // Password field focus
    DOM_STRUCTURE: 20,       // Full page DOM
}

// Sent with EVERY event:
{
    uid: "abc123",           // Persistent user ID
    gaia: "google_id_12345", // Your Google Account ID
    tz: -300,                 // Your timezone (location)
    history: true,           // Has history access
    action: "input_focus",
    extra: {
        fieldType: "password", // They know you're entering a password
        url: "https://mybank.com/login"
    }
}

Source: guard.js (2MB bundle) - Chrome Web Store

// wotApi.js - POST to api.mywot.com/v3/query
{
    target: WotCrypto.encrypt(url),  // URL encrypted (but WOT decrypts it)
    id: this.witness.id,           // Persistent tracking ID
    iged: encoder.encode({
        iged: all_links_array        // ALL links on the page
    }),
    lk: encodeURIComponent(JSON.stringify({
        forms: 3,                    // Login forms detected
        inputs: ["password", "email"],
        links: 15,
        scripts: 7,
        iframes: 1
    }))
}

// DOM structure extracted:
handleMessageElements(pageData, tab);
// Extracts: forms, inputs, iframes, links, images, scripts, styles

Source: wotApi.js, tabsCache.js - WOT 5.9.1

// manifest.json - Telemetry endpoints
{
    "permissions": [
        "webRequest",        // Intercept ALL HTTP requests
        "tabs",              // See all tab URLs
        "downloads",         // Monitor downloads
        "unlimitedStorage",
        "nativeMessaging"
    ],
    "host_permissions": [""]
}

// Sentry error tracking (sends stack traces):
"https://[email protected]/4506062147551232"

// Telemetry endpoints:
"https://telemetry.malwarebytes.com"
"https://hubble.mb-cosmos.com/hashes"

// Content script on Google Account:
"https://myaccount.google.com/*"  // Monitors your Google account

Source: manifest.json - Malwarebytes Browser Guard 3.1.1

// background.js - Passive DNS to virustotal.com
POST https://www.virustotal.com/core/v2/backend/resolutions/ingest

// Hardcoded API key shared by ALL users:
'X-Apikey': '285e5270519c...72a'

// Every DNS resolution sent:
{
    data: [{
        type: "Resolution",
        attributes: {
            host_name: "example.com",      // Domain you visited
            ip_address: "93.184.216.34"   // Resolved IP
        }
    }]
}

// Files automatically uploaded:
if (!fileExistsInVT) {
    uploadFile(fileContent);  // Complete file up to 100MB
}

// Hidden message in code: "dont be evil" (while tracking everything)

Source: background.js - VT4Browsers 5.0.0 (Google/VirusTotal)

// firewall.bundle.js - Crypto transaction interception
{
    "permissions": [
        "storage",
        "tabs",
        "webRequest"         // Intercept ALL requests
    ],
    "host_permissions": [
        "https://domain-api.scamsniffer.io/*",
        "*://*/*"             // Access to ALL websites
    ]
}

// Every crypto site checked:
fetch("https://domain-api.scamsniffer.io/check", {
    url: currentUrl,        // Full URL sent
    wallet: walletAddress   // Your wallet address
});

// Only for crypto, but still sends URLs

Source: manifest.json, firewall.bundle.js - Scam Sniffer 0.0.60

What SafeMode sends instead
// SafeMode only sends: { hash: "f7a3b9c2e1..." // Anonymous content fingerprint } // That's it. No URL. No user ID. No tracking. // We literally cannot know what site you're on.

Our Business Model: Prevention, Not Surveillance

Unlike other security companies, we don't monetize your browsing data. Our business is simple: protect people from phishing. Here's why we don't need to invade your privacy:

We Analyze Threats, Not You
Our AI analyzes phishing pages from public threat feeds. We study attackers, not users. Your browsing behavior is irrelevant to our detection methods.
Hash-Based Verification
Content is analyzed locally and we only send anonymous hashes to our servers for verification. We never see the URLs you visit, only content signatures.
Sustainable Revenue Model
We offer premium features for power users and enterprise API access. We don't need to sell your data because we have a real product.

Why Organizations Trust Us

5,000+
Phishing Pages Analyzed Daily
We process thousands of confirmed phishing URLs every day from multiple threat intelligence sources, ensuring our database is always current.
<1ms
Average Detection Time
Fast local pre-filtering combined with server hash verification provides near-instant threat detection. Protection that doesn't slow you down.
0
URLs Sent to Our Servers
We only receive anonymous content hashes, never the actual URLs you visit. Your browsing history stays private - we can't identify which sites you're on.
24/7
Continuous Monitoring
Our systems run around the clock, analyzing new threats as they appear. When a new phishing campaign launches, we detect it within minutes.

Your Privacy Is Non-Negotiable

SafeMode was built with privacy-first architecture. We use content hashing - only anonymous signatures are sent to our servers for verification, never the actual URLs or page content you're viewing.

Many security tools claim to protect you while secretly tracking everything you do online. They sell your browsing data to advertisers or use it to build profiles. We believe that's fundamentally wrong. Security and privacy should not be mutually exclusive.

What Other Extensions Collect

  • WOT & Guardio: Track every URL you visit and sell aggregated data
  • VirusTotal: Logs DNS queries and file hashes, owned by Google/Alphabet
  • Guardio: Can read your keystrokes on any page for 'protection'
  • Malwarebytes: Sends browsing telemetry to their servers continuously
Install SafeMode Learn More