# SecureCheck

**A privacy-first, client-side security toolkit for everyday users.**

No server. No tracking. No accounts. Everything runs directly in your browser.

---

## What It Does

SecureCheck provides two quick, free safety checks:

### 🔗 URL Phishing Risk Checker
Paste any link and get an instant risk verdict — **Low**, **Medium**, or **High** — based on a set of rule-based heuristics that run entirely offline:

| Rule | Score |
|---|---|
| Not using HTTPS | +1 |
| IP address as host instead of a domain | +2 |
| Domain name is suspiciously long (>30 chars) | +1 |
| Excessive subdomains (>3 dots) | +1 |
| Known URL shortener (bit.ly, tinyurl.com, etc.) | +1 |
| Domain looks like a known brand (Levenshtein ≤ 2) | +3 |
| Suspicious keyword in path/query when combined with other triggers | +1 |
| `@` symbol present (hides the real destination) | +2 |

**Score-to-verdict:** 0–1 = Low (green) · 2–4 = Medium (yellow) · 5+ = High (red)

Every triggered rule is shown as a plain-English explanation beneath the verdict badge.

### 🔑 Password Breach Checker
Uses the **Have I Been Pwned Pwned Passwords** API with the [k-Anonymity model](https://haveibeenpwned.com/API/v3#PwnedPasswords):

1. Your password is hashed client-side using SHA-1 via the WebCrypto API.
2. Only the **first 5 hex characters** of that hash are sent to the API.
3. The API returns all hash suffixes that share that prefix (~500 entries).
4. Your browser compares them locally — your full hash and password never leave your device.

---

## Project Inspiration

Most "security tools" require you to hand over the very data they're protecting. URL scanners upload your links to a server. Password checkers sometimes transmit passwords in plaintext. This project is a proof-of-concept that neither compromise is necessary:

- URL analysis can be done entirely with regex and string algorithms.
- Password checking can be done with **k-Anonymity** — a clever API design where the server never learns what you're actually looking for.

The goal was to build something useful, fast, and trustworthy without any external dependencies.

---

## Tech Stack

| Layer | Technology |
|---|---|
| Structure | Semantic HTML5 |
| Styling | Vanilla CSS (custom properties, Flexbox, Grid) |
| Logic | Vanilla JavaScript (ES2020+, no frameworks) |
| Hashing | `crypto.subtle.digest` (Web Crypto API, built into browsers) |
| Breach data | [HaveIBeenPwned Pwned Passwords](https://haveibeenpwned.com/API/v3#PwnedPasswords) (free, no API key) |
| Font | [Inter + JetBrains Mono](https://fonts.google.com/) via Google Fonts CDN |

---

## What Was Learned Building It

- **Levenshtein distance** is surprisingly effective at catching brand spoofs like `paypa1`, `amaz0n`, and `g00gle` without any ML or external data. Implementing it from scratch revealed the elegant dynamic-programming structure behind it.

- **The k-Anonymity trick** is a beautiful piece of API design. By sending only a prefix of the hash, the server returns a superset of possible matches — the client does the final comparison. This means the server has no idea what specific hash (or password) was being queried. Troy Hunt wrote a [great blog post](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/) about the design.

- **`URL` constructor quirks**: The native `URL` API parses the `@` character as a credential separator. `http://user:pass@host.com` → hostname is `host.com`. This means phishing tricks like `http://paypal.com@evil.com/` are parsed differently than you might expect — `evil.com` is the actual host — which is exactly the behavior the `@` rule in this tool detects.

- **URL shorteners vs. real domains**: Distinguishing `t.co` (shortener) from `tco.com` (not a shortener) required building a small exact-match allowlist rather than using prefix matching.

- **CSS custom properties** make dark-mode theming maintainable at scale — a single `:root` block controls the entire color system.

---

## Running Locally

No build step required. Just open the file:

```
# Option A — open directly (works for all features except the HIBP API call,
#             which may be blocked by CORS on some browsers without a server)
open index.html

# Option B — serve locally (recommended; any static server works)
npx serve .
# or
python -m http.server 8080
```

Then open `http://localhost:8080` in your browser.

---

## File Structure

```
├── index.html    — Page structure and markup
├── style.css     — All styles (dark theme, responsive, no framework)
├── script.js     — URL analyzer + HIBP password checker
├── README.md     — This file
└── LICENSE       — MIT License
```

---

## Privacy

- No analytics. No cookies. No local storage writes.
- URL analysis is 100% offline.
- Password checking: only a 5-character SHA-1 hash prefix is sent. Your password never leaves your device.

---

## License

MIT — see [LICENSE](LICENSE).