toolcrate
All tools →
🔗 checked locally — the URL is never sent anywhere to "check" it

URL Safety Signal Checker

Paste a link to see objective phishing-adjacent signals (hidden real domain, IP-address host, punycode/homograph risk, excessive subdomains) before you click. This reports signals, not a verdict - and unlike most "is this link safe" checkers, the URL never leaves your browser to be logged somewhere.

How it works

The URL you type is parsed with the browser's native URL API and checked against a fixed set of structural signals — an embedded username/password before an @, a raw IP-address host, a punycode (xn--) hostname, an unusually deep subdomain chain, non-HTTPS traffic, a non-standard port, and query parameters like redirect or next that point straight at another URL.

FAQ

Does a clean result mean the link is definitely safe?
No — it only means none of this tool's specific structural signals, like an IP-address host, punycode, the @ credential trick, or an open-redirect parameter, were found; a phishing link can still look structurally normal on a freshly registered domain.
What is the "@" credential trick it checks for?
Browsers treat everything before an @ in a URL as login credentials and everything after it as the actual host, so a link like https://paypal.com@evil.com really goes to evil.com — this tool flags that pattern by reading the URL's real parsed hostname.

Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.

Say thanks — $3