How can we help?

One security app for your Mac and iPhone, and an extension for Chrome and Brave. It stops fake sites before they load, tells you whether a text, email, link or call is a scam, pauses big payments while you think, ranks missing updates by whether attackers are using them, shows what every app on your Mac sends and to whom, and checks the devices on your Wi-Fi.

HARD is in early access. Leave your email on the app page and we’ll write once, when your place is ready, with how to install it. Then follow the install steps in the docs.

• A Mac on macOS 14 or later.
• An iPhone on iOS 17 or later.
• Chrome or Brave, version 116 or later, for the extension.

iPad, Windows, Android, and Edge, Firefox and Safari aren’t supported yet. They’re coming.

No. It goes after what people actually lose money to: convincing calls and messages, fake sites and sign-in pages, and software with holes attackers are already using.

Neither. Keep using your password manager. HARD watches for the moment a password is about to go to the wrong site, and for the scam around it.

When it opens, every 30 minutes, whenever the network changes, and when something new lands in Applications or the folders where programs set themselves to run in the background. The first check learns what’s normal; after that, anything new is reported as a change.

macOS asks you to allow a network filter once. Open System Settings → General → Login Items & Extensions, find Network Extensions, and allow HARD. Then macOS asks whether HARD may filter network content: choose Allow. Step by step.

• Watch (the default) allows everything except known-bad sites, and keeps a record of every connection.
• Ask me asks the first time an app connects somewhere new. If you don’t answer within 60 seconds, the connection is allowed.
• Lock down blocks every new connection unless you’ve allowed it. Apple’s own services keep working.

Open System Settings → Network → Filters and switch HARD on. HARD has a button that opens the right page. If you use a VPN, it uses its own DNS while it’s connected.

macOS is limiting what HARD can reach on your network. Turn on HARD in System Settings → Privacy & Security → Local Network, then scan again.

Open Firewall and DNS in HARD. Under Connections, turn on Only show blocked to see what was stopped and why. Rules you’ve made are listed under Your rules, where you can delete one. In Lock down, anything you haven’t allowed is blocked.

Yes. Select the text, then choose Services → Check with HARD from the app’s menu, or paste it into Is this legit? in HARD.

In the iPhone’s Settings, go to Apps → Messages → Unknown & Spam → SMS Filtering and choose HARD. Scam texts from numbers you don’t know go to Junk.

No. iOS only passes HARD texts from numbers that aren’t in your contacts, and HARD checks them on the phone. Nothing leaves it, and your contacts’ messages are never checked.

If they want money moved, a code read out, or your screen shared: hang up, and call the number on the back of your card or the organisation’s own website. Then open Is this legit?, choose the call option and answer the yes-or-no questions. HARD tells you what it thinks and what to do.

• Stops lookalike addresses (g00gle.com, letters from other alphabets) and known phishing sites before they load.
• Blocks suspicious addresses registered in the last 60 days.
• Spots copied sign-in pages on someone else’s domain.
• Clears your Google, Microsoft or Apple password if you type it on the wrong site.
• Pauses big payments, new payees and crypto withdrawals on banks and exchanges.
• Warns when a remote-control tool like AnyDesk is open beside your bank.
• Checks every extension you’ve installed.

On a bank, payment app or crypto exchange, HARD pauses a payment at or over your threshold (2,000 by default, in whatever currency the site uses), a new payee, a crypto address or a withdrawal, and asks the questions scammers hope you won’t. You can wait 10 minutes, cancel, or continue. If a remote-control tool is open, the 10 minutes always run. Change the threshold, or mark a site as your bank, from the extension’s popup.

No. When you sign in on the real Google, Microsoft, Apple or similar site, it keeps a salted one-way hash of the password, so it can recognise it being typed somewhere else. The password itself is never stored or sent.

Open HARD for Mac once. It registers itself with Chrome and Brave, and the extension’s warnings then show up in HARD’s activity on the Mac.

Not yet. In early access, the extension comes with your invitation. A store listing is coming.

You and a family member pair once, in person: one of you shows a QR code, the other scans it. After that, both apps show the same six-digit code for each other, changing every 30 seconds. When someone who sounds like them calls from a new number asking for money, ask for their HARD code. Match: it’s them. No match, or “I can’t open the app right now”: hang up and call them back on the number you already have.

No, on purpose. A pairing link sent remotely is refused, so someone who isn’t in the room can’t join in. Pairing family overseas is planned.

Only on the two devices, in the Keychain. They’re never synced to a server or put in backups, and HARD never sends a code anywhere. Codes are read aloud.

Up to six people, each with their own HARD on their own devices. Organisers can add people and manage someone else’s HARD. Everyone else just gets protected.

The alerts that matter, like a transfer HARD paused or a fake site it stopped, and what needs fixing on their devices. Not their messages, their browsing or their bank balance.

Yes. Set it up together, on their devices, with their agreement. HARD is for protecting people, not for watching them. See the terms.

Family plans are part of early access. Family sharing and managed accounts are still being finished, so we’ll set them up with you when your place is ready.

On every plan, the Operator chat in HARD for Mac answers straight away with HARD’s agent. It can look at a screenshot you send and knows what HARD has found on your Mac. It uses Claude, so messages and screenshots go to Anthropic: never send passwords or one-time codes.

With a short, private call, under NDA if you like. Then two weeks of discovery on your accounts, devices, homes and people, a written report ranked by real-world risk, and fixes: critical findings in 72 hours, the rest by week six. After that, your engineer is there for as long as you need. Request an introduction.

Your engineer is on call at any hour. How to reach them directly is set up with you when your membership starts.

Personal is US$4 a month and Family US$7 a month, billed yearly (US$48 and US$84). Business is US$9 a person a month. HARD Operator is US$2,750 a month or US$33,000 a year. See the plans.

Early access terms will be confirmed when your place is ready, and you’ll see them before you pay. Nothing in them takes away your rights under consumer law. See the terms.

Yes, for HARD Operator, and HARD Business is made for teams.

HARD sees the attack, not your life. What it finds, your traffic numbers, firewall log and HARD codes stay on your devices. The text filter runs on the iPhone. Text leaves your device only when you ask: the optional Claude second opinion and the Operator chat send what you write to Anthropic, and the app says so first.

HARD downloads public lists: known phishing sites, criminal networks, Apple’s and Google’s security notes, and the flaws listed by CISA and NIST’s NVD. To look up a flaw, it sends a product or router name to NVD. To judge a suspicious address, it asks a public registry how old the domain is. The full list is in the privacy policy.

App data lives on your devices: deleting the app and its folder removes it (see Uninstalling). To remove your email from our lists, or anything you’ve sent us, use the support form and choose Privacy.