PhishNet AI
How it works
AI-assisted analysis

Know what you're looking at
before you click.

Paste a suspicious email or message. PhishNet reads it, scores the risk, and shows you exactly which signals it found.

Try:
0 / 12,000

Password generator

NIST SP 800-63B

Phishing exists to harvest credentials. This follows NIST SP 800-63B, which means it optimises for length rather than symbols, and shows you the entropy maths instead of a vague strength bar.

—
— 0 bits

—

—

Why there are no forced symbols

SP 800-63B tells verifiers not to impose composition rules. Requiring a capital, a digit and a symbol was dropped from the guidance because it produces predictable shapes and drives password reuse, while adding very little real entropy. Length does the work instead.

The same document also says not to force periodic rotation. Rotate on evidence of compromise, not on a calendar. Arbitrary expiry makes people increment a digit, which an attacker who has one old password can guess.

Randomness comes from crypto.getRandomValues(), not Math.random(), and index selection uses rejection sampling so no word or character is more likely than another. Generation happens entirely in this browser. Nothing is sent anywhere.

Known gap: SP 800-63B also says candidate passwords should be screened against known-breached lists. This tool does not do that, because a generated random passphrase is vanishingly unlikely to appear in a breach corpus. If it accepted user-supplied passwords, screening would be required.

How it works

  1. 1

    You paste a message

    Your message is sent to Google's Gemini API for analysis and is not stored by PhishNet. Scan history lives only in this browser, and clearing it removes it.

  2. 2

    A model reads it

    The request goes to a backend function that holds the API credentials. The key never reaches your browser.

  3. 3

    Signals get named

    You get a score, the specific signals found in your text, and what to do next.

Read this before you rely on it

PhishNet AI is an educational tool that uses a language model to assess text. It can be wrong in both directions: it may flag a legitimate message, and it may miss a well-crafted attack.

A low score is not a guarantee that a message is safe. It analyzes text only. It does not inspect links, attachments, email headers, or sender reputation, all of which matter. Treat it as a second opinion, never as your only one.