Paste a suspicious link and see the phishing tricks in it, without ever opening the link
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.A phishing link usually gives itself away in its text - a lookalike letter from another alphabet, a trusted name placed before an @, or a real domain pushed to the end. This checker reads a link for 12 such tricks and never opens it, so checking it is safe.
Paste the link into the box under The link; it is read as text and never opened.
If the message showed the link as different words, type them into The words the link was shown as.
Read the verdict and the Goes to and Real name lines to see where the link really leads.
Press Copy report to keep the findings, or choose from Examples of each trick to see what each looks like.
Paste a link from an email, a text message or a chat, and this page reads it the way a browser would, then lists anything that looks like a trick. It never opens, fetches or previews the link, and it never sends it anywhere, so checking a dangerous link here cannot harm you.
The tricks it looks for are the ones phishing relies on. Lookalike domains replace a Latin letter with an identical one from Cyrillic or Greek; the address bar may show "apple.com" while the real name is xn--pple-43d.com, and the page shows both forms and names the substituted letter. The @ trick puts a trusted name before an @ sign, which a browser treats as a user name, so https://[email protected] goes to that IP address, not to the bank. A fake prefix such as paypal.com.account-verify.example looks like PayPal on a narrow phone screen, but the domain is the part at the end. The checker also flags bare and disguised IP addresses, invisible or direction-changing characters, plain http, links hidden inside other links, and well-known shorteners such as bit.ly and tinyurl.com, which conceal the destination. Paste the words the link was shown as, too, and it compares them with the real address.
To check a QR code, use the QR Code Safety Check page: choose a photo or screenshot of the code, it is decoded on your device, and the link inside goes through the same analysis before anybody opens it.
What this cannot do: tell you that a link is safe. A clean result means no trick is visible in the text, not that the site behind it is honest; a brand-new scam domain with an ordinary name passes. The page does not use a list of "bad" top-level domains, because no stable published list exists to cite, and it does not check reputation services. When in doubt, type the company's address yourself instead of following the link.
Copy the link, usually by long-pressing it on a phone or right-clicking on a computer, and paste it into the box above. The page reads the text of the link for known phishing tricks and never opens it. A clean result means no trick is visible, not that the site is trustworthy.
No. The link is analysed as text by JavaScript in your browser. It is never fetched, previewed, resolved in DNS or sent to our server or to any reputation service, and the result shows it as plain text rather than as something clickable, so pasting a dangerous link here is harmless.
Domains may contain letters from any alphabet, stored in DNS as Punycode starting with xn--. Scammers register names where one Latin letter is swapped for an identical Cyrillic or Greek one, so xn--pple-43d.com can display as apple.com. The checker decodes the name and names the substituted letter.
A shortener such as bit.ly, tinyurl.com or t.co hides the real destination until the link is opened, so nothing about the final site can be read from the text. Most shortened links are harmless. When one arrives unexpectedly, ask the sender for the full address instead of following it.
Yes. The checker finds tricks visible in the link's text, but a new scam site with an ordinary-looking domain shows none. It does not consult blocklists or reputation services. For banks, tax refunds and deliveries, type the official address yourself rather than trusting any link in a message.
Open the QR Code Safety Check page and choose a photo or screenshot of the code. The image is decoded on your device, never uploaded, and the link inside is shown as text with the same phishing analysis. Only then decide whether to type or open the address.
Still stuck? Ask about Link Safety Checker and anybody who knows can answer. No account needed.
Also works as: QR Code Safety Check.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.