Install PhishTriage
PhishTriage is a free add-on for your web browser. It gives you a quick second opinion, in plain words, on whether an email or a website can be trusted. This page shows you how to add it.
Before you start
- You need a computer with one of these web browsers: Google Chrome, Microsoft Edge, Mozilla Firefox or Brave. A browser is the program you use to visit websites.
- PhishTriage doesn’t work on phones or tablets. It doesn’t work in Safari either.
- You don’t need an account, an email address or a password.
- PhishTriage’s own screens are in English.
Not sure which browser you use? Look at the icon you click to go online. Chrome’s is a red, yellow and green circle with a blue centre. Edge’s is a blue and green wave. Firefox’s is an orange fox wrapped around a purple globe. Brave’s is an orange lion’s head.
Add PhishTriage to your browser
Open this page in the browser you want to protect. Then follow these steps.
Click the link for your browser. It opens PhishTriage’s page in that browser’s add-on store.
- Chrome: PhishTriage in the Chrome Web Store
- Edge: PhishTriage in Microsoft Edge Add-ons
- Firefox: PhishTriage in Firefox Add-ons
- Brave: use the Chrome Web Store. Brave installs add-ons from there.
Click the big install button near the top of the store page. It usually names your browser, for example “Add to Chrome” or “Add to Firefox”. In Edge’s store it may just say “Get”.
Your browser now asks whether to add PhishTriage. A small box appears. It lists what PhishTriage will be allowed to do, and names the Gmail and Outlook websites. In Firefox, it may also say that PhishTriage collects website content, personal communications and personally identifying information.
Click the button in that box that adds PhishTriage, such as “Add extension” or “Add”.
This question is normal. Your browser asks it for every add-on. The words come from your browser, not from us, so they look a little different in each browser.
PhishTriage needs the Gmail and Outlook websites so it can put its button there. It doesn’t read any email until you ask it to.
In Firefox, the list of what PhishTriage collects is expected too. When you click Analyze, the email or page you’re checking is sent to us. An email usually contains your own email address. PhishTriage sends no email or page until you click Analyze.
A new tab opens with the title Welcome to PhishTriage. That means PhishTriage is installed. The Welcome page below explains what’s on it.
If the store won’t let you add it: Firefox needs version 142 or newer. To update it, open Firefox’s menu, choose Help, then About Firefox. On a work computer, your employer may decide which add-ons you can install. If so, ask your IT team.
Keep the PhishTriage icon in view
You use PhishTriage through a small icon at the top right of your browser. The icon is a line drawing of a shark. When you point at it, it says PhishTriage.
Browsers often hide a new add-on at first. Here is how to keep the icon where you can see it.
Chrome, Edge and Brave
At the top right of your browser, click the puzzle-piece icon. A list of your add-ons opens.
Find PhishTriage in the list.
Click the small icon next to it that keeps it in the toolbar. In Chrome and Brave, it’s a pin. The PhishTriage icon now stays next to the address bar.
In Edge, PhishTriage may already be in the toolbar. If you can see the shark icon, you can skip these steps.
Firefox
Firefox also keeps add-ons behind a puzzle-piece icon at the top right. Click it, and you’ll find PhishTriage in the list. Firefox lets you pin it to the toolbar from there.
If you can’t pin it, that’s fine. Click the puzzle-piece icon, then PhishTriage. It opens just the same.
Check that it works
Stay on any ordinary website, such as this one.
Click the PhishTriage icon. A small window opens. This is the PhishTriage window. At the top it says Ready.
phishtriageReadyPage detectedClick Analyze to triage the current page content.▶ Analyze Current Page⚙ SettingsWhat you see when you click the icon on an ordinary website. In Gmail, or in Outlook at outlook.live.com, outlook.office.com or outlook.office365.com, it says Gmail detected or Outlook detected instead, and the button says Analyze Current Email. Click anywhere outside the window to close it. You don’t need to change anything.
The Welcome page
The Welcome page opens once, straight after you install. It says Installed at the top, then “Know if it’s phishing, in seconds.”
Everything is already set up, so you can read it or skip it. From top to bottom, it has these sections:
- “Keep PhishTriage one click away”: the same steps as above, to keep the icon in view.
- “Click Analyze, get a verdict”: a reminder of how a check works. Open an email or a website, click the PhishTriage icon, then click Analyze.
- “Catch dangerous sites while you land”, with a switch called Enable threat monitoring. It starts off. When it’s on, PhishTriage checks each website you open and warns you if it’s known to be dangerous. Your browser asks for permission first. In the PhishTriage window the same switch is called Background protection. You can leave it off for now. Turn on Background protection explains it.
- “Check files before you open them”, on some browsers only, with a switch called File protection. It starts off, and you can leave it off.
- “Keep evidence of phishing”, with a switch of the same name. This switch is already on. When you check a website and the answer is “Don’t trust this” or “Be careful”, PhishTriage sends us two things. One is a picture of what you can see in that tab. The other is the page’s code. That lets the site be reported and taken down. PhishTriage never does this in Gmail, or in Outlook at the three addresses shown above. Any other webmail is checked as a website, so it can happen there. That includes Yahoo Mail and Outlook at outlook.cloud.microsoft. There, the picture shows your inbox, and the code includes the email you had open. You can switch it off here, or later in the PhishTriage window. What PhishTriage sees has the details.
On a work computer, your organisation may have set some of these switches for you. You can’t change those here.
At the bottom are two buttons, Skip for now and I’m ready. Both simply close the Welcome page. Any switch you changed is already saved.
To see the Welcome page again later, click the PhishTriage icon. Click Settings, then View welcome / onboarding.
No account needed
PhishTriage doesn’t ask you to create an account. It never asks you to type your email address or a password. The first time it runs, it sets itself up on its own. It gives your browser a random code that isn’t based on your name or your email.
Signing in is optional. Under Settings in the PhishTriage window there’s a Log in button. You only need it for two things. One is to see your checks in the PhishTriage portal, our website. The other is to join your workplace’s team. Checks you made before signing in aren’t shown there. Signing in uses your Google account, on Google’s own page.
What to read next
- Check an email in Gmail or Outlook.
- Check a website that feels wrong.
- Understand the answer PhishTriage gives you.
Something not working? See Something isn’t working, or write to support@phishtriage.com.