Phishing protection

A fake site gets nothing from ZZPass.

Scam pages copy the look of your bank perfectly. They can't copy its web address. ZZPass offers your password only on the site it belongs to, so when it stays quiet, that's your warning.

How it worksMatching on the real address Spot a fakeThree checks that take seconds Already typed it in?What to do right now

Your password knows where it belongs.

ZZPass compares the address of the page you're on with the website saved on each login. It looks at the real domain, the part a scammer can't fake.

The page you're on	Your Apple login (apple.com)
`www.apple.com`	Offered
`appleid.apple.com`	Offered: same domain, different part of the site
`apple-verify.com`	Not offered: a different domain
`apple.com.account-check.net`	Not offered: the real domain here is account-check.net
`appIe.com` (a capital I)	Not offered: a lookalike, not the same name

The rule: if you expect ZZPass to offer a login and it doesn't, stop. Check the address before you type anything, and don't search ZZPass to fill it by hand.

More layers, already built in.

See the site

The sheet names the website

On iPhone, AutoFill asks "Sign in to netflix.com?" before it fills, and the ZZPass list shows the site you're on at the bottom. Read it once before you tap.

Passkeys

Passkeys can't be phished

A passkey only works on the site that created it, and there's nothing to type. Where a site offers one, save it in ZZPass. About passkeys

2FA codes

A stolen password isn't enough

With a 2FA code on the account, a scammer needs that too. ZZPass keeps the code with the login and fills it for you. Set up 2FA codes

One password per site

One mistake stays one account

If every login has its own generated password, a phished one opens nothing else. Password Health shows where you've reused one. The generator

Spot a fake in seconds.

Read the domain
Find the name just before the first single /, then the part before .com or .co.uk. paypal.com.secure-login.io is secure-login.io.
Distrust the hurry
"Your account closes in 24 hours" and "confirm this payment now" are how scams make you skip step 1.
Go there yourself
Don't use the link in the email or text. Open the app, or type the address you know, and check from there.

Already typed your password in?

Move fast, but calmly. The sooner you change it, the less the scammer can do.

Go to the real site yourself and change that password. Let ZZPass generate the new one.
Turn on 2FA for the account if it's offered, and store the code in ZZPass.
If you used the same password anywhere else, change it there too. Password Health lists reused ones.
Check the account's recent activity, and call your bank on the number on your card if money is involved.

Report it

Help get the fake taken down

Fake Apple messages: forward to reportphishing@apple.com
In the UK: forward emails to report@phishing.gov.uk
In the US: forward to reportphishing@apwg.org, and report at reportfraud.ftc.gov
Anywhere: tell the company being impersonated

Quick answers.

Will ZZPass fill my password on a fake site?

Not as a suggestion. ZZPass only offers a login on the domain it was saved for. You could still search for it and fill it by hand, which is why a missing suggestion is your cue to stop.

Why doesn't ZZPass suggest my login on a real site?

The site may use a different domain for sign-in, for example a bank that logs in through another address. Check that the domain really belongs to the company, then add it as an extra website on the login so ZZPass offers it there next time.

Does ZZPass check my passwords against data breaches?

No. Password Health flags weak passwords and passwords you've used on more than one site. Apple warns about leaked passwords for logins saved in Apple Passwords.

Do passkeys stop phishing completely?

For that account, yes in practice: a passkey only signs in to the site it belongs to, and there's no password to hand over. Scammers can still try to trick you in other ways, like asking for a code by phone.

Is there a ZZPass browser extension?

Not yet. ZZPass fills through Apple's AutoFill on iPhone, iPad and Mac, in Safari and in apps.

Let ZZPass check the address. Every time.

Free on iPhone, iPad and Mac.

How AutoFill works →