How Safari Privately Blocks Phishing Websites

This article explains how the Safari web browser protects users from malicious phishing sites without compromising their privacy. By combining Google Safe Browsing databases, cryptographic hashing, and Apple-operated proxy servers, Safari verifies the safety of websites predominantly on your local device. This multi-layered approach ensures that neither Google nor Apple can see the websites you visit or link your browsing activity to your IP address.

The Privacy Problem with Phishing Protection

To protect users from phishing scams and malware, web browsers rely on massive, constantly updated databases of known dangerous websites. Safari uses the Google Safe Browsing service for this data (and Tencent Safe Browsing in mainland China).

If Safari simply sent every URL you visited to Google to check if it was safe, Google would have a real-time log of your entire browsing history tied directly to your IP address. Safari prevents this by using cryptographic hashes and proxy servers.

Step 1: Downloading the Hash Prefixes

Instead of checking websites in real-time with a server, Google Safe Browsing creates a list of known malicious URLs and runs them through a cryptographic algorithm (SHA-256). This turns every bad URL into a unique, unreadable string of characters called a hash.

To save space, Google truncates these hashes, leaving only the first few characters, known as a "hash prefix." Safari periodically downloads this compact list of hash prefixes and stores it locally on your iPhone, iPad, or Mac.

Step 2: The Local Device Check

When you type a URL into Safari or click a link, the browser does not immediately contact the internet to verify the site's safety. Instead, it performs the following actions locally on your device:

  1. Safari converts the URL you want to visit into a SHA-256 hash.
  2. It looks at the beginning of that hash (the prefix).
  3. It compares this prefix against the list of bad hash prefixes already downloaded on your device.

If the prefix does not match anything on the local list, the website is deemed safe, and the page loads. No data leaves your device, and no outside servers are contacted.

Step 3: Using Apple Proxy Servers

If the hash prefix of the website you are visiting matches a prefix on the local list, the site might be dangerous. However, because prefixes are just short fragments of a full hash, safe websites and dangerous websites occasionally share the same prefix.

To confirm if the site is actually fraudulent, Safari must request the full-length hashes associated with that specific prefix from Google Safe Browsing. Sending this request directly to Google would expose your IP address and give Google a hint about what site you are visiting.

To prevent this, Safari routes the request through an Apple proxy server:

  1. Safari to Apple: Safari sends the matching hash prefix to an Apple proxy server. Because it is only sending a hash prefix, Apple does not know the actual URL you are trying to visit.
  2. Apple to Google: The Apple proxy server strips away your IP address and forwards the hash prefix request to Google Safe Browsing using Apple’s own IP address.
  3. Google to Apple: Google receives the request, sees only Apple's IP address, and returns a list of all full-length malicious hashes that start with that specific prefix.
  4. Apple to Safari: The Apple proxy forwards Google's response back to your device.

Step 4: Triggering the Warning

Once your device receives the list of full-length hashes from the proxy, Safari compares them to the full hash of the website you are trying to visit.

If there is an exact match, Safari blocks the page from loading and displays the red "Fraudulent Website Warning" screen. Throughout this entire process, Google never sees your IP address, Apple never sees the URL you are visiting, and neither company knows the final result of the check.