Free Link Safety Checker
Got a link in a text, an email or a DM and not sure about it? Paste it here before you tap it. We follow it to where it really ends up, check who owns the domain and how old it is, and look for the warning signs scammers rely on you missing.
Free · No sign-up · Nothing stored
At a glance
- We visit the link, not you. It's opened on our server, without running its scripts, so you can see the destination before deciding.
- The real owner is the domain just before the ending (.com, .co.uk), not whatever comes first in the address.
- The strongest warning signs: a look-alike or brand-imitating domain, a domain registered days ago, and a login page for a brand on a domain that isn't theirs.
- It's not a malware scan. "No warning signs" isn't a guarantee, so for anything involving a password or payment, type the address yourself.
What the link safety check looks at
Most dangerous links don't look dangerous. They look like a delivery update, a shared document or a security alert from a brand you use. So the checker doesn't judge the message; it checks the facts about the link itself:
| Signal | What we check | Why it matters |
|---|---|---|
| Where it really goes | Unwraps short links and follows every redirect to the final page | Short links and redirect chains hide the destination |
| Look-alike domains | Letters swapped for numbers (paypa1), one-letter typos, international look-alike characters | Built to be skimmed past |
| Brand before the domain | A brand name in front of a different real domain (paypal.com.verify-now.top) | The most common trick in phishing texts |
| Domain age | The registration date from the public domain registries | Most phishing domains are days or weeks old |
| https and certificate | Whether the page is encrypted and its certificate is valid | Anything typed on an http page travels unprotected |
| Fake login pages | A password form on a page that names a brand it doesn't belong to | The classic credential-stealing pattern |
| Forms sent elsewhere | A login form that posts to a different domain from the page | Your details go to someone else's server |
| Downloads | Links that lead straight to an .exe, .apk, .zip or similar file | Unexpected files are a common way in for malware |
How to check if a link is safe before you click it
You can do most of this by hand in under a minute. The checker does all of it at once:
- Preview the address. On a computer, hover over the link; on a phone, long-press it. Don't tap yet.
- Find the real domain. Look at the part before the first single slash and read it from the right: the ending and the word before it are the owner.
login.paypal.comis PayPal;paypal.com.login-help.topbelongs tologin-help.top. - Unwrap short links. bit.ly, t.co and similar addresses hide the destination. Paste them here to see where they go.
- Check the details: paste the link into the checker for the domain's age, the certificate and every redirect.
- Never sign in from a link you didn't expect. Open the brand's app or type its address yourself, then look for the same message there.
Reading the result
| Verdict | What it means | What to do |
|---|---|---|
| No warning signs found | None of the signs above showed up | Still type the address yourself before signing in or paying |
| Double-check | Something unusual, such as a young domain, no https or several redirects | Make sure it's the site you expected |
| Warning signs | A look-alike domain, a brand-new domain, an invalid certificate, a fake login or a download | Don't sign in, pay or download |
Below the verdict you'll see the final address, each redirect on the way, the certificate's issuer and expiry, and the domain's registration date. Every warning comes with a plain explanation of why it matters.
Worked example: a fake "PayPal" link, taken apart
Here's the kind of link that arrives in a text saying your account is on hold (an illustration, not a real site): https://paypal.com.account-review.top/signin. It starts with "paypal.com", which is all most people read on a small screen. Taken apart:
- The real domain is account-review.top. "paypal.com" is just a label in front of it, which the checker flags as a brand placed before the real domain.
- The domain is days old, which the registry lookup shows as a serious warning.
- The page asks for a password while its title says PayPal, on a domain PayPal doesn't own: the checker's strongest signal.
- The padlock means nothing here. Scam sites get free certificates too; https proves the connection is encrypted, not that the owner is honest.
For a real result, we ran the checker on our own homepage. It found no warning signs except one: cmoowls.com is only about two months old. That's true, and a useful reminder that a young domain on its own isn't proof of a scam. It's one signal to weigh, which is why the checker explains each finding instead of only giving a score.
Links people most often ask about
- Delivery and toll texts ("your parcel is held", "unpaid toll"): almost always imitation domains. Check, then track the parcel in the carrier's own app.
- Shared documents (Google Docs, Drive, Dropbox, DocuSign): the real ones live on google.com, dropbox.com and docusign.com or .net. A "document" link on another domain that asks you to sign in is a red flag.
- Discord, Instagram and gaming DMs offering free items or "verify your account": check the domain and never enter your login on a page you reached from a DM.
- Short links in ads and posts: usually fine, but unwrap them to see the destination first.
- QR codes: scan with your camera, copy the link it shows and paste it here before opening.
If you've already clicked
- Didn't type anything? Close the tab. Opening a page alone rarely causes harm on an up-to-date phone or browser.
- Entered a password? Change it on the real site now, and anywhere else you use it. Turn on two-step verification.
- Entered card or bank details? Call your bank using the number on your card.
- A file downloaded? Don't open it. Delete it and run your device's security scan.
- Report it, so it gets taken down faster: forward phishing texts to your carrier's spam number (7726 in the US and UK) and report the site to the brand it imitates.
What a link safety check can't do
- It doesn't check malware or phishing blocklists. Services like Google Safe Browsing aren't free for commercial use, so we don't use them. A clean result here isn't a guarantee.
- It doesn't run the page's scripts. A page that redirects again with JavaScript may lead somewhere we don't show (we flag pages that look like they do).
- Sites change. A link can be harmless when we check and swapped later.
- It can't see behind a login or into files, and it doesn't judge whether an offer is too good to be true. That part is still up to you.
A link safety check on one map
To see every hop of a redirect in detail, use the Redirect Checker. If you run a website, check that your own links don't send visitors anywhere broken with the Broken Link Checker, and that your domain's email records stop people sending scam email as you with the Security Headers Checker.
Keep your own site's links trustworthy
Watch Owl crawls up to 500 of your pages in a real browser and reports broken links, failed requests and security settings, worst first.
Frequently asked questions
How can I check if a link is safe without clicking it?
Paste it into the checker. We visit it from our server, not your device, follow every redirect and report where it ends up and any warning signs. On a phone you can also long-press a link to see its address before opening it.
Does "no warning signs" mean the link is safe?
No. It means none of the signs we check for showed up. We don't check malware blocklists, and a site can change after we look. If a message pushes you to sign in, pay or download something, go to the company's site by typing its address yourself.
How do I check a bit.ly or other short link?
Paste the short link as it is. The checker follows it to the real destination and shows every step, so you can see the final domain before you decide to open it.
What makes a link look suspicious?
A domain that imitates a brand (paypa1.com, amazon-billing.xyz), a brand name placed before the real domain (paypal.com.secure-login.top), a domain registered days ago, no https or an invalid certificate, a long chain of redirects across different sites, and a page that asks for a password on a domain that doesn't belong to the brand it shows.
How do I read a web address to see who owns it?
Find the part just before the first single slash and read it from the right: the ending (.com, .co.uk) and the word in front of it are the real domain. In https://paypal.com.secure-login.top/login the real domain is secure-login.top, not PayPal.
Why does the checker say a real site is young?
Because it looks up the registration date and reports it, whatever the site. A young domain on its own isn't proof of anything; plenty of new businesses are honest. It matters most when a brand-new domain claims to be a long-established company or asks for a login.
Is it safe to paste a suspicious link here?
Yes. The link is opened by our server, which reads the page without running its scripts and never downloads files to you. Nothing you paste is stored.
What should I do if I already clicked a phishing link?
If you didn't type anything, close the page. If you entered a password, change it on the real site straight away and anywhere you reuse it, and turn on two-step verification. If you entered card details, call your bank. If a file downloaded, don't open it and run a security scan.
Can it check links in emails, texts and DMs?
Yes. Copy the link (on a phone, long-press it and choose Copy Link) and paste it in. That works for delivery texts, Discord or Instagram DMs, Google Docs and Drive share links, and anything else with a web address.
Agents that do this for you
Related reading