Free · In this browser · The link stays here
Is This Link Safe
Paste an address and get a plain-language reading of it: which part is the real site, and which tricks are sitting in the text. The check is instant and never opens the link.
Check a link
This is a heuristic check, not a guarantee. A clean address can still be harmful, and a flagged address can belong to a real organization. Nothing you paste is opened, stored, or sent anywhere.
Paste a link, or try one of the tricky examples. The check stays in this browser.
Try a tricky link
These are made-up addresses using the reserved example name, a documentation IP, or a shortener token that does not need to be opened. Choosing one fills the box and runs the same check.
How a link is read
A web address is a sentence with a strict grammar, and phishing works by hoping you will
not parse it. The website is not the first familiar word. It is the registrable name: the
label just before the ending, read from the right. In
https://accounts.example/login, the site is example.
accounts is a subdomain. Anyone who owns example can write whatever they want
on the left.
https :// paypal.com @ signin . example /webapps/login
The browser opens signin.example. paypal.com is a username. The same rule catches a brand parked in a subdomain, as in paypal.com.account-verify.example: the owner is example, and the PayPal words are decoration.
What the checks look for
Lookalike names swap a letter for a digit or a hyphen, so paypa1.com and pay-pal.com are not PayPal. Homoglyphs and punycode go further: a character from another alphabet can draw an a, an o, or a p that is a different code point. The xn-- form is how a browser stores those letters. This page decodes it and shows you the letters themselves.
A raw IP address has no name to recognize. http leaves the connection open. A shortener hides the destination, so the rest of the checks cannot see it. A very long address, a pile of subdomains, or an ending that shows up constantly on throwaway sites is a reason to slow down, not a conviction on its own. A path or query can spell a famous company, or hide a second address inside percent-encoding. Folders do not change who owns the host.
What a verdict means
Looks OK means none of these patterns fired. Be careful means at least one weak or situational flag fired, such as http, a shortener, or a risky ending. Likely dangerous means the address uses a trick that exists to misname the site: an @ sign, a lookalike, a brand in the subdomain, a public IP, or a company name hiding in the path. None of the three is a promise. This is a heuristic check, not a guarantee, and it never visits the page.
If the link is asking for a password, a payment, or a download, ignore the text you were sent and open the service from a bookmark you already trust. For the password you would type there, the password strength checker stays on this device too. Choose Your Own Hack puts the same decision inside a fictional text, call, or cafe network.
FAQ
Does this open the link or send it anywhere?
No. The address is read in your browser and then discarded. This page does not fetch the URL, follow redirects, or send the text to an analytics event. You can confirm that in the browser network panel: checking a link adds no request.
Is Looks OK a guarantee?
No. This is a heuristic check, not a guarantee. It only inspects the characters in the address. A link can look ordinary and still lead to a harmful page, and a flagged link can belong to a real organization. When money, a password, or a download is involved, open the site from your own bookmark instead.
How do you read the real domain?
Read the host from the right. The website is the registrable name just before the ending, such as example.com. Words to the left are a subdomain and can say anything. Text before an @ sign is a username, not the site. The page highlights that split for the link you paste.
What is the @ trick?
In a web address, the host is the text after the last @. A link can put a familiar name in front of that sign, as in https://[email protected]/login. The browser opens signin.example. paypal.com is only a username.
What is punycode?
Punycode is the xn-- form browsers use for letters outside basic English. It is how many real international sites are stored, and it is also how lookalike letters from another alphabet hide inside a familiar word. This check decodes those labels and shows the letters you would actually be trusting.
Why are shorteners flagged?
A shortener such as bit.ly replaces the destination with a short token. The page you will land on is not written in the address, so the other checks cannot see it. Be careful is a prompt to ask for the full link, not a claim that the shortener company is malicious.