Is this link actually safe to click?
Paste any URL below. In under a second you’ll get a plain-English risk report — no signup, no data sent anywhere, nothing installed.
How to use the checker
Understanding your results
Risk score
All 16 signals the checker runs
| Signal | What it checks | Why it matters |
|---|---|---|
| HTTPS | Whether the link is encrypted | Baseline for any site handling data |
| IP hostname | Raw IP address instead of a domain | Legitimate sites use domain names |
| “@” trick | Text before an @ in the address | Browsers ignore it — used to hide the real host |
| Punycode | Encoded international characters | The mechanism behind homograph lookalikes |
| Shortener | Known link-shortening services | Hides the real destination pre-click |
| TLD risk | Domain ending reputation (.xyz, .top…) | Disproportionately used in phishing |
| Subdomain depth | Number of subdomain levels | Used to bury a brand name in the address |
| Brand match | Known brand names outside the real domain | Makes a link look trustworthy at a glance |
| Hyphen count | Number of hyphens in the domain | Common in bulk-registered lookalike domains |
| Urgency words | “verify”, “suspend”, “confirm” in the path | Pressure tactics common in credential theft |
| Non-standard port | A port other than 80/443 in the URL | Rare for consumer sites, sometimes used to dodge filters |
| Typosquat distance | Domain within 1–2 characters of a known brand | Catches paypa1.com, arnazon.com-style lookalikes |
| Dangerous file type | Link ends in .exe, .apk, .zip, .jar, etc. | Common pattern for malware delivery links |
| Redirect parameter | A query string carrying a second embedded URL | Can silently forward you somewhere other than it appears to |
| Domain-in-domain | A real TLD (.com, .org) buried mid-hostname | Makes the address bar look right at a glance, e.g. paypal.com.xyz |
| URL length | Overall character count of the link | Very long URLs often bury the real domain or pack in tracking params |
How each red flag actually works
The table above is the quick version. Here’s the mechanism behind the signals that most often separate a real phishing link from a clean one — with a worked example for each.
Typosquatting
Attackers register a domain one or two characters off a real brand — swapping a letter, adding one, or dropping one. paypa1.com (a “1” for an “l”) and arnazon.com (“rn” for “m”) both read as the real thing at a glance in most fonts. The checker measures edit distance against a list of frequently-targeted brands.
Homograph attacks
Domains can contain characters from non-Latin alphabets that render almost identically to Latin letters — a Cyrillic “а” instead of a Latin “a”, for instance. Browsers store this internally as punycode, prefixed xn--. It’s invisible in the address bar unless you know to look for the prefix.
The “@” trick
In a URL, everything before an @ symbol is treated as login credentials for the host that comes after it — and browsers silently discard it. https://paypal.com@malicious.net looks like it’s going to paypal.com but actually connects to malicious.net.
Domain-in-domain
Placing a recognizable domain ending in the middle of a longer hostname exploits how people skim URLs left-to-right and stop early. paypal.com.security-check.xyz is not a subdomain of paypal.com — the real, registered domain is security-check.xyz.
Open-redirect parameters
Some legitimate sites have redirect features (?next=, ?continue=) that forward visitors to a second URL. If poorly secured, attackers embed a malicious destination inside a trusted domain’s redirect parameter, so the visible link looks safe right up until the jump.
Subdomain burying
The real, registered domain in any URL is always the last two labels before the path — everything else is a subdomain the domain’s owner can name freely. secure.paypal.login.example.com belongs entirely to example.com, not PayPal.
What is a phishing URL?
A phishing URL is a web address built to look legitimate so it can trick someone into entering credentials, financial details, or personal information. Most arrive by email, text, or social media, and often imitate a bank, delivery service, or well-known brand.
Common tactics
↳ the real domain is malicious-domain.com — “paypal” is just a subdomain label built to look convincing, not the actual brand site.
Phishing isn’t just one thing
“Phishing” covers several distinct attack patterns. The link checker above is built for the URL-based ones — but it helps to recognize all of them, since the delivery method changes what a red flag even looks like.
Email phishing
The classic version — a mass email impersonating a bank, retailer, or service, with a link to a fake login page.
Spear phishing
Targeted at one person or company using real details (your name, employer, a real colleague) to look convincing.
Whaling
Spear phishing aimed at executives — often impersonating a CEO or CFO to authorize a wire transfer or data request.
Smishing
Phishing by SMS text — a fake delivery notice or bank alert with a shortened link, exploiting the small screen.
Vishing
Voice phishing — a phone call impersonating support or a bank, sometimes paired with a link sent mid-call.
Clone phishing
A real, previously-delivered email is copied and resent with the legitimate link swapped for a malicious one.
Pharming
DNS-level redirection that sends you to a fake site even when you type the real domain correctly — no link needed.
Angler phishing
Fake customer-support accounts on social media that DM “help” links to people publicly complaining about a brand.
Quishing
QR codes that decode to a malicious URL — bypasses email link scanners entirely since there’s no clickable text.
How to eyeball a link without any tool
The checker above catches structural red flags fast, but it’s worth knowing what to look for manually too — especially on your phone, where the address bar is often hidden or truncated.
Legitimate vs. phishing, field by field
| Legitimate | Phishing | |
|---|---|---|
| Domain | paypal.com | paypal-secure-login.com |
| Protocol | https:// with a valid certificate | Often http://, or https:// on an unrelated domain |
| Sender address | service@paypal.com | service@paypal.mail-alerts.net |
| Link text vs. actual URL | Match when hovered/long-pressed | Display text says “paypal.com” but the real link goes elsewhere |
| Tone | Informational, no artificial deadline | Urgent — “act within 24 hours” or “your account is locked” |
| Personalization | Uses your actual name and account details | Generic greeting — “Dear Customer” or “Dear User” |
Before you click
Frequently asked questions
Paste the full URL or domain into the checker above and click Check URL. You’ll get an instant risk score and a full breakdown of which structural signals were found — no signup required.
No. A high score means no structural red flags were found in the URL itself — it doesn’t check live phishing blocklists or the actual page content. New phishing pages appear constantly, so treat this as a first line of defense, not the only one.
Plain HTTP instead of HTTPS, a risky TLD (.xyz, .tk, .gq), deep or unusual subdomain nesting, non-ASCII or encoded characters, a brand name outside the actual domain, and URL shorteners.
Disconnect from the internet, run a malware scan, change any passwords you entered, and monitor your accounts for unusual activity. If you entered payment details, contact your bank immediately.
Not directly — this checker analyzes the structure of the URL itself, entirely in your browser, so results are instant and nothing is sent to a server. Use the Google Safe Browsing and VirusTotal links included with every result for a live database check on the same link.
Live badges against services like Google Safe Browsing or OpenPhish require a server making outbound API calls — something a browser-only tool can’t do securely. This checker trades that for something a server-based tool can’t offer: instant results with nothing ever transmitted.
The checker will flag it as a shortener, but can’t see through it to the real destination — browsers block that kind of cross-site lookup for privacy and security reasons. Expand the link first with a service like CheckShortURL, then paste the real destination in.
Not with certainty — it means the URL shares structural patterns with known phishing techniques. Some legitimate services do use shorteners or unusual subdomains. Treat a low score as a strong reason to verify through another channel before entering any information.
No. Every check runs in JavaScript inside your own browser tab. The URL you paste is never transmitted to a server, logged, or stored anywhere — closing the tab clears it completely.
Report it to the brand being impersonated (most have a dedicated abuse or phishing address), forward it to the Anti-Phishing Working Group at reportphishing@apwg.org, and mark it as phishing in your email client so future messages from that sender are filtered.
