-
Paste any suspicious email or text. SafeSignal runs entirely on your device, so nothing you type is uploaded, saved, or seen by anyone.
-
A phishing email flagged “Likely a scam”, with a plain next step and the exact red flags: fake link, urgency, credential request.
-
A normal message reads “No clear red flags”. SafeSignal still says that isn’t proof it’s safe. Hear it read aloud or copy to share.
-
Practice mode: guess safe or scam, then see the verdict and a one-line lesson. It builds the instinct that actually protects you.
Inspiration
The riskiest moment in everyday digital life is the message you hesitate to click — the "your account is suspended" email, the "I need gift cards" text from your "boss," the "parcel on hold, pay a fee" SMS. Non-experts can't easily tell a scam from a real message, generic advice ("just be careful") doesn't help, and pasting a private message into an online checker leaks it. I wanted a tool that explains the warning signs on the spot, keeps the message completely private, and teaches people to spot the next one.
What it does
Paste a suspicious email or text (and optionally the raw email headers). SafeSignal gives an honest, at-a-glance verdict — No clear red flags, Be careful, or Likely a scam — leads with a plain-language next step, and lists the specific warning signs it found, each with why it's suspicious, what to do, and the exact evidence. It detects urgency, password/OTP/card requests, disguised, look-alike and obfuscated links, direct money and gift-card/crypto requests, "guaranteed returns" investment fraud, arrest/fine threats, "bank details changed" invoice fraud, reverse-OTP ("read back the code we sent"), QR "quishing", phone-callback vishing, risky attachments, hidden characters, and — from headers — sender spoofing and SPF/DKIM/DMARC failures.
It also helps you get better: a gamified "Practice spotting scams" mode (guess safe/scam on real-looking messages, then see the verdict and a one-line lesson), a read-aloud option for low-vision or low-literacy users, and a one-tap shareable summary you can forward to a relative.
How I built it
Pure client-side JavaScript. A single detection engine (analyzer.js) drives both the UI and an automated test suite. There is no backend and no network call of any kind — privacy is enforced by architecture, not by a promise, and even the speech and sharing features stay local. The design is a deliberate "public-safety notice" direction: a light, calm, highly legible layout with a traffic-light verdict as the hero, aimed at the non-technical and vulnerable people scammers target most.
Challenges I ran into
Calibrating heuristics to be useful without crying wolf. A lone macro-malware attachment or a spoofed-header message must rank high, while a legitimate "beware of scams" bank notice must stay low — and the tool must not cheat by matching the word "scam." I encoded that as a principled rule and pinned it with tests, then ran two adversarial QA passes over 25 realistic scam types and 13 legitimate messages until every case classified correctly.
Accomplishments that I'm proud of
A working, tested, genuinely private tool that explains its reasoning, stays honest about its limits, and teaches people — not a black box. 42 automated tests pass.
What I learned
Specific, explained signals beat a single "risk %", and much of trustworthy safety tooling is honest framing (absence of signals is not proof of safety) rather than detection cleverness.
What's next for SafeSignal
More languages (including Arabic for the UAE), browser-extension packaging, and an optional on-device model — all kept local to preserve privacy.
One safer outcome: someone who gets "Your PayPal account is suspended — verify within 24 hours: http://paypa1-secure.top/login" sees it flagged Likely a scam, with the look-alike domain and the credential request named, and is told to reach PayPal through the official app instead of clicking.
One limitation: SafeSignal is a heuristic learning aid. It can miss a well-crafted scam and occasionally over-flag a legitimate message; it can't verify a sender or scan a live link, and it is not a replacement for your provider's security or for emergency services. All demo data is synthetic.
Credits / AI disclosure: original first-party work built during the event window. Built with AI assistance (an AI coding assistant helped with design, implementation, and tests); all code was reviewed and is original to this project. No third-party code or datasets are bundled. MIT-licensed.
Built With
- css
- heuristics
- html
- javascript
- no-backend
- node.js
- privacy
- web-speech-api
