Broader learning access
Add language options and test lessons with students and families to improve clarity.
The project
About PhishWise
PhishWise is an educational web app that helps students, families, and other beginners recognize phishing warning signs, practice safer decisions, and understand suspicious messages.
Purpose
Make phishing awareness easier to learn.
A suspicious message can imitate an everyday school notice, delivery update, or account alert. PhishWise turns those situations into short, approachable lessons and practice questions. Its purpose is to support better judgment; it does not promise to prevent every scam.
The project focuses on students and other people new to cybersecurity. Examples use familiar situations and explain the reason behind each recommendation.
Features
Learn, apply, and check.
01 / LEARNING CENTER
Four short lessons
Six warning signs, a fictional annotated message, response steps, and a glossary.
02 / MESSAGE CHECKERExplain the warning signs
Checks pasted text against six groups of patterns and explains possible concerns.
03 / KNOWLEDGE CHECKSixteen topic questions
Four topic quizzes with explanations, progress, section scores, and retakes.
04 / LINK INSPECTORLook beyond the URL
Inspect structural clues locally and optionally retrieve domain registration dates from public RDAP records.
HOW IT WORKS
How it works
- JavaScript
- Matches message text against predefined patterns and manages quiz questions, answers, feedback, and scores.
- HTML & CSS
- Provide the pages, lesson structure, responsive layout, and clear educational design.
- Local processing
- The message checker does not send pasted text to an analysis server. URL structure checks also run locally. Optional domain-age lookups send only the registered domain to a public RDAP registry. Quiz scores remain in page memory and reset on reload or navigation away.
- Development tools
- OpenAI Codex assisted with implementation, local preview, testing, and publication through Sites. These development tools are separate from the app’s message-checking logic.
AI disclosure: This prototype was developed with substantial AI assistance from OpenAI Codex, including generated page code, styling, checker and quiz logic, and automated checks. Human direction in this development conversation shaped the cybersecurity focus, darker theme, topic quizzes, and Learning Center. The running message checker uses rules, not an AI model.
DESIGN DECISIONS & LIMITS
Limitations
- Signals are not proof. Ordinary messages can trigger a pattern, while scams can avoid familiar phrases. The checker explains this instead of labeling a message “safe.”
- Scores need consistent state. Answer buttons lock after one selection, sections restart independently, and retaking a completed quiz replaces that section’s score.
- Examples should be safe to explore. Fictional addresses are shown as text. The checker never opens submitted links.
- Scope is limited. There is no sender authentication, threat-reputation lookup, mailbox monitoring, browser extension, or automatic scam blocking. Domain records do not establish website legitimacy.
Validation during development covered all 16 quiz questions, independent scores, wrong-answer feedback, retakes, duplicate-answer protection, local navigation, and lesson expansion. This is functional testing, not a security audit or a measured study of scam prevention.
POSSIBLE VERSION 2.0
What could come next?
Better learning feedback
Add more varied scenarios and an optional, consent-based way to retain learning progress.
More careful analysis
Expand the current URL structure and registration checks with evaluated threat-reputation sources and privacy controls. Threat-reputation checks are not included in the current app.
TOOLS & RESEARCH REFERENCES
References
Official past-winner showcases were reviewed as references for presenting a clear problem, purpose, and working demonstration: Phishing Hook (2025) ↗ describes games and a scam-email simulation, while SafeNet CyberSecurity (2023) ↗ discusses security tools and awareness. PhishWise keeps its own phishing-prevention focus, tools, examples, copy, and design. These references guide presentation only and do not endorse PhishWise.
Domain parsing uses tldts 7.4.19 under its MIT license. Registry endpoints come from the IANA RDAP directory. Public domain records may be unavailable or incomplete.
EXPLORE THE WORKING APP