URL Security Checker
Check a link for security red flags before you visit it — entirely in your browser.
What This Tool Actually Checks
Everything above runs as a heuristic, browser-side scan — there's no server involved, so nothing about the link you paste is sent anywhere. That also means the checks are limited to what can be inferred from the URL string and a fetch response, not a real threat-intelligence lookup. A few of the more easily misunderstood checks:
- Punycode / lookalike domains — flags URLs where letters are encoded to visually mimic a trusted brand (e.g. a Cyrillic "а" standing in for a Latin "a"). This catches the encoding, not the intent behind it.
- Redirect chain — shows every hop between the link you pasted and where it actually lands. A long chain isn't automatically dangerous, but it's worth knowing before you click.
- SSL certificate — confirms the connection is encrypted. A valid certificate means the traffic can't be easily intercepted; it says nothing about whether the site itself is trustworthy.
Does a "Low Risk" score mean the link is definitely safe?⌄
No. It means none of the browser-side checks found a red flag — it isn't a guarantee. Malicious sites can pass every check here and still be harmful, since real phishing and malware databases require a server-side lookup (see the "Details" tab above).
Why do some checks show "Unavailable"?⌄
Advanced checks like phishing- and malware-database lookups need a server-side threat-intelligence source, which isn't available without signing in. This tool intentionally never fakes a result for those.
What is a punycode phishing attack?⌄
It's a technique where a domain name uses look-alike characters from another alphabet to spoof a well-known brand name in a browser's address bar. The rendered text can look identical to the real domain, which is why checking the underlying encoding — not just what's displayed — matters.