CertiLens runs six independent security engines in parallel — Certificate Transparency, domain age, DNS authentication, security headers, DOM heuristics, and homograph detection — and synthesizes them into a single risk score before the page finishes loading.
Most extensions compare your URL against a database. CertiLens actively analyzes the site itself — even if it's never been seen before.
Promise.all(). Total scan time is ~2s, not 15s.Each engine catches a different class of attack. Together they handle brand-new phishing domains that no blocklist has ever seen.
Queries CT logs for every certificate ever issued to the domain. A cert issued in the last 7 days is a strong phishing signal — attackers can't buy old certificates.
Checks eight response headers: CSP, HSTS, X-Frame-Options, X-Content-Type, Referrer-Policy, Permissions-Policy, COOP, and COEP. Legitimate sites configure these. Phishing sites don't.
Uses RDAP — the JSON-based successor to WHOIS — to check domain registration date. Most phishing domains are registered days before an attack. No API key needed.
Checks for SPF and DMARC records via DNS-over-HTTPS. Missing these records means anyone can send phishing emails that appear to come from this domain.
The injected content script scans the live DOM for password fields on HTTP, cross-origin form actions, hidden iframes, obfuscated JavaScript (eval/atob), and page identity–based brand spoofing.
Identifies IDN homograph attacks: Cyrillic/Greek lookalike characters, mixed Unicode scripts, punycode domains, and digit-for-letter substitution like paypa1.com. Runs entirely offline.
Every point in the 0–100 score is traceable to a specific finding. No black box — you see exactly why a site was flagged.
CertiLens was built by Jalen Joseph, a high school junior holding CompTIA Security+, Network+, and ITF+ certifications. What started as a way to apply classroom security concepts became a full-featured browser security tool that mimics the detection logic of enterprise EDR browser agents.
The project demonstrates applied knowledge across four Security+ domains — PKI and certificate validation, threat and vulnerability analysis, multi-layer security architecture, and security operations.
Every design decision has a reason: RDAP instead of WHOIS because it returns structured JSON; parallel engine execution because total scan time should be bounded by the slowest API, not the sum; identity-only brand spoofing checks because scanning full page text produces false positives on legitimate search engines.
No account. No API keys. No build step.
git clone https://github.com/JalenTechHub/CertiLens
chrome://extensions/
CertiLens is built and maintained solo by a high school student — no company, no team, no budget. If it has helped you stay safer online, a small contribution goes a long way toward keeping it alive and improving it.