FAQ

Does Unmask read all my email? No. It reads only the email you have open, and only while the panel is open. Nothing is stored or sent anywhere unless you click an online check.

Does it need my Google password or Gmail access permissions? No. It uses Gmail's own "Show original" feature in your already signed-in tab. There's no OAuth and no Google API access.

Why "No red flags found" instead of "Safe"? Because no tool can prove an email is safe. New attacks can pass every check. Unmask tells you what it found and what it didn't.

A legitimate email got a warning. Is that a bug? Not necessarily. Some legitimate senders do things phishers also do, such as using link shorteners or sending from a new domain. Read the explanation and judge for yourself. If a check is clearly wrong, open an issue.

Why do newsletters show trackers? Most marketing emails include tracking pixels so senders know who opened them. That's a privacy matter, not phishing, so trackers don't raise the risk score.

Is it free? Can it ever cost me money? Unmask is free and open source (MIT). VirusTotal and urlscan.io have free plans, and free keys can't be billed: if you exceed a limit, the service just refuses requests until it resets. Paid plans exist only for heavy or commercial use. Full details: Free limits and costs.

---

This page is generated from docs/USER_GUIDE.md. Edit it there, not in the wiki.