🛡️ URL Safety Checker

Analyze a Link

This checker dissects the URL itself using defensive heuristics — the same red flags security trainers teach. It never visits the site, so a dangerous link can't harm you here. Nothing you paste is uploaded anywhere.

Try a sample:

The 6 Red Flags This Checker Looks For

• Punycode & homographs — domains like xn--pypal-4ve.com render as look-alike brand names using foreign alphabets. Your eyes see “paypal”, the computer sees a different site entirely.
• IP-address hosts — real banks and companies use domain names. A link like http://203.0.113.9/login hides who operates the server.
• The “@” trick — in https://paypal.com@evil.com, everything before @ is ignored decoration; you actually land on evil.com.
• Shortened links — bit.ly-style links hide the destination. Expand them before trusting them.
• Subdomain floods — login.bank.secure.verify.evil.com is owned by evil.com; the trustworthy part of a domain is at the end, not the start.
• No HTTPS / strange length — missing encryption on a login page, or a URL hundreds of characters long stuffed with redirects, both deserve suspicion.

Honest Limits

No checker can guarantee a link is safe. A clean result means “no common red flags in the address itself” — a brand-new phishing site on a normal-looking domain can still pass. Always navigate to banks and key accounts by typing the address yourself or using your own bookmark, never via a link in an unexpected message. This is a defensive, educational tool only.