Phishing detection that tells you why a message is suspicious, not just that it is.
PhishWall is a detection engine that runs entirely on your own computer. It reads a message, scores the links and the wording, checks the sender's authentication records, cross-references live threat feeds — and then shows you the specific evidence behind its verdict, so you can judge it rather than trust a number.
Outlook is the first client. The engine itself is not tied to it: it runs as a local service and answers over a local HTTPS API, which is what lets other clients be added without re-implementing detection. A Gmail extension is now in preview; Outlook remains the supported one.
Download for Windows · Download for macOS
macOS builds are signed and notarized by Apple. Gatekeeper verifies them for you, so the app opens normally with no warning and no right-click trick.
Windows builds are not signed, so SmartScreen will warn about an unknown publisher. There, checking the SHA-256 below is how you confirm the file you received is the file the build produced — worth doing precisely because there is no signature to lean on.
Loading checksums…
| Signal | What it means |
|---|---|
| Link analysis | Structure of every link — lookalike domains, suspicious hosting, raw IP addresses, known-bad URLs |
| Message wording | Language patterns that match phishing, learned from ~89,000 real examples |
| Sender checks | SPF, DKIM and DMARC results, and whether Reply-To quietly differs from the sender |
| Threat feeds | Cross-referenced against ~800,000 phishing URLs and ~440,000 domains, refreshed daily |
Every verdict comes with the reasons behind it, plus which features pushed the score up or down.
Windows will warn you about an unknown publisher. That is expected — the installer is not code-signed. Choose More info → Run anyway if you are comfortable proceeding. It needs no administrator rights: it installs to your user folder and is removable from Add or remove programs like any other application.
macOS is signed with a Developer ID certificate and notarized by Apple, so it just opens. Drag PhishWall into Applications in the window that appears.
Windows will show you a security warning, and it will look alarming. It says Windows cannot validate the certificate, that installing it means Windows will automatically trust any certificate issued by this authority, and that doing so is a security risk.
That warning is accurate, and you should read it rather than click through it. Here is what it means in this case.
Why PhishWall needs it. Outlook only loads add-ins over HTTPS. No public
certificate authority will issue a certificate for software running on your own
machine, because there is no way to prove you own localhost. So PhishWall
creates its own, and asks your operating system to trust it.
What it can and cannot do. The certificate is generated on your computer when you first run PhishWall, the private key never leaves it, and it is unique to you — nobody else has it, including us. It is used only to secure the connection between Outlook and PhishWall on this machine. It cannot be used to intercept your browsing, impersonate a website, or read traffic to anywhere else. Uninstalling removes it.
Verify the thumbprint before accepting. Windows shows a SHA-1 thumbprint and warns that installing a certificate with an unconfirmed thumbprint is risky. It is right, and you can confirm it. From a terminal:
%LOCALAPPDATA%\PhishWall\phishwall.exe --show-ca-thumbprint
macOS:
/Applications/PhishWall.app/Contents/MacOS/phishwall --show-ca-thumbprint
That prints the thumbprint of the certificate PhishWall generated. If it matches the dialog, the prompt came from PhishWall. If it does not match, decline — something else is asking for root trust.
We cannot publish the expected value here, because the certificate is created on your machine and is different for every user. That is the point of it.
If you decline, PhishWall still runs and still scans, but Outlook will refuse to load the task pane, because it will not talk to an untrusted HTTPS endpoint. You can approve it later by restarting PhishWall.
This is the one manual step. Microsoft does not allow programs to install Outlook add-ins, so it cannot be automated.
Get the manifest file. The installer already put one where you can find it, so you should not need to download anything:
Documents\PhishWall\PhishWall-manifest.xmlPhishWall-manifest.xml, sitting next to the app in the disk
image you just openedIf you have deleted it, or want it separately: download the manifest.
Open aka.ms/olksideload
Choose My add-ins → + Add a custom add-in → Add from File, and pick that file
Choose Install, then quit and reopen Outlook
Open any email and PhishWall appears in the reading pane.
PhishWall is a detection engine, not an Outlook feature — it answers over a
local API, so any client can use it. The Gmail client is a Chrome extension
that reads the open message and asks the same engine for a verdict. Your mail
still never leaves your machine; the extension talks only to
https://localhost:8765.
This is a preview, and one limitation is worth knowing before you rely on it. It has been tested against a live Gmail account, but Gmail's page layout is not a published interface — Google changes it without notice — so it may stop reading messages at some point. When that happens the panel says "Not scanned" rather than staying silent, because a security tool that quietly shows nothing is indistinguishable from one saying "this is fine". Treat it as a second opinion alongside your own judgement, not as cover.
There are two builds. Most people want the first one.
Detection runs entirely inside your browser. No desktop app, no server, and the extension asks for no network permissions at all, so your mail cannot leave the machine.
Download the standalone extension
chrome://extensions and turn on Developer mode, top right.That is all. Click the PhishWall icon in the toolbar for a self-test.
It carries its own detection models, the phishing-word cues, a list of 100,000 known-good domains and a filter holding over a million known-phishing URLs, so the download is around 11 MB. Two things differ from the version below: the threat list is fixed when you install rather than refreshed daily, and the guidance is rule-based rather than written by a language model. Both are stated on every result.
Uses the PhishWall app on your computer, so the threat list stays current and the guidance is richer. Requires the app installed and running.
Download the connected extension
Same three steps, plus: make sure PhishWall is running, then visit https://localhost:8765/health once and accept the certificate. Chrome will not let the extension reach PhishWall until you have, and this is the most common reason the panel says it cannot connect.
Open a message in Gmail and the verdict appears bottom-right.
Brave and Edge work — both are Chromium-based and load the extension the same way; the steps above are identical, and the menu will say "Remove from Brave" rather than Chrome. Firefox and Safari are not supported.
What it can see. The browser will tell you the extension can "read and
change site data". That is the content script reading the open message, which
is the whole job — but it is limited to mail.google.com and cannot touch any
other site. It asks for one other thing, permission to reach
https://localhost:8765, which is PhishWall on your own machine. That is the
complete list.
Your email never leaves your computer. Message text, subjects, senders and attachments are analysed locally and are never transmitted.
Two settings, both off by default, in the panel at the bottom of PhishWall:
External lookups — when the local model is unsure about a link, check it against urlscan.io's public index. Only that link is sent, only when you enable this.
Help improve detection — contribute anonymous data about phishing infrastructure: the shape of malicious links, the servers that sent them, authentication failures. Never your email, never your address, never anyone else's. If a link contains your email address — phishing kits often personalise them — that is stripped before anything is sent.
Windows: Settings → Apps → PhishWall → Uninstall
macOS: drag PhishWall from Applications to the Bin, then run
/Applications/PhishWall.app/Contents/MacOS/phishwall --uninstall-certs and
--uninstall-autostart first if you want the certificate and login item gone
too. The scripts/uninstall.sh in the source folder does all of it.
Both remove the application, its certificate, and the entry that starts it when
you sign in. Your feedback history is kept
unless you pass --purge, because those corrections cannot be regenerated.
Removing the Outlook add-in is separate: aka.ms/olksideload → My add-ins → PhishWall → Remove.
Removing a Gmail extension is separate too: chrome://extensions →
PhishWall for Gmail (or PhishWall for Gmail (standalone)) → Remove.
The standalone one leaves nothing else behind, since it never installed
anything outside the browser.
On Windows the uninstaller asks Windows to delete PhishWall's certificate, and Windows shows a confirmation dialog naming it — PhishWall Local CA, issuer Self Issued. Answer Yes. To check afterwards that nothing was left behind, open PowerShell and run:
Get-ChildItem Cert:\CurrentUser\Root | Where-Object { $_.Subject -eq 'CN=PhishWall Local CA' }
No output means the certificate is gone, which is what should happen.
The task pane says it can't load. PhishWall must be running — check for it in your system tray or Activity Monitor. If it is running, quit and reopen Outlook: the certificate is only read at startup.
Windows blocked the installer. SmartScreen warns about any application it has not seen before, signed or not. More info → Run anyway, if you are comfortable. macOS does not do this — those builds are notarized.
Verdicts look wrong. Use the feedback buttons in the panel. Corrections are stored locally and improve the model over time.
PhishWall is provided as-is, with no warranty. It is a detection aid and will not catch everything — treat it as one signal alongside your own judgement, never as a guarantee that a message is safe.