URL Safety Check
Check a suspicious web address before you open it. The analysis runs in your browser: the address is never sent to a server.
Copy the suspicious link without clicking it, then paste it below. ToolPilot examines the real domain name, the characters it uses and several common signs of phishing.
URL safety check — inspect a suspicious link before opening it
Why check a URL before clicking?
A domain name can be written with characters that look almost exactly like the usual letters. The Latin « o » (U+006F) and the Cyrillic « о » (U+043E) are two technically distinct characters whose shapes are practically identical on screen. A fraudster who registers a domain containing such a character obtains an address visually indistinguishable from a well-known brand's, complete with a valid HTTPS certificate and a padlock in the address bar. The Unicode Consortium documents this technique, and publishes the UTS #39 technical standard and the confusable character tables this tool relies on.
Deceptive characters are only part of the problem. An address can also place a fake domain before an @ character — the browser opens what follows, not what precedes. It can stack subdomains so the real domain scrolls off a phone screen. It can write an IP address in decimal form so that it does not look like an IP address. It can slip in a zero-width space that the browser silently removes, landing on a different domain from the one you read. This tool examines each of these mechanisms separately and explains the ones it finds.
The analysis is deliberately passive. ToolPilot does not open the address, does not load it, follows no redirect and asks nothing of the domain being examined. A phishing link often contains a unique identifier that tells its author the target has clicked; visiting it, even with a tool, amounts to answering. The examination therefore covers only the text of the address — which has another benefit: it runs in your browser, without the address being sent to anyone.
A result with no signal does not mean a site is safe. A domain can be perfectly well written and still host a fraudulent page, just as an address can look strange and be legitimate. The tool passes no verdict on a site's content: it reports what its address reveals, with the reasons, so the decision stays yours.
Common use cases
- Check a link received by text message or email
- Delivery notice, parking fine, tax refund, bank alert: these pretexts come back constantly. Copy the link with a long press, without opening it, and paste it here to see which domain it actually points to.
- Inspect a domain that resembles a brand
- When an address looks right without quite being right, comparing Unicode skeletons answers in a second: it matches the address against the most-imitated domains and reports a visual resemblance to a different domain.
- Awareness and training
- The tool shows the offending character, its Unicode name and the letter it imitates. It is concrete material for explaining, at work or at home, why an address can lie without any apparent spelling mistake.
- Inspect a link before passing it on
- Before forwarding an address to a team or a relative, checking the main domain and the characters used avoids circulating a phishing link.
How does the URL safety check work?
Paste the address into the field, without ever having had to open it, and start the analysis. The protocol may be omitted: the tool assumes https, as a browser would, and tells you so.
The address is split by a parser that works on the exact text you pasted, then compared with what a browser would make of it. The domain name is examined character by character — code point, script, Unicode category, identifier status — and the domain actually registered is determined with the Public Suffix List, the only reliable way to tell example.co.uk from example.com.
Every unusual element becomes an explained signal, ordered from the most serious to the most innocuous. The final result is one of four states: no suspicious signal, suspicious elements, dangerous address, or analysis not possible. Weak clues are capped: an unusual port and three subdomains can never add up to a red alert.
Frequently asked questions
- Is the address I paste sent to ToolPilot?
- No. The analysis is performed by your browser, using data embedded in the page. The address being examined is not sent to any server, and no request is made to the analysed domain. You can verify this yourself in the network tab of your browser's developer tools.
- Does the tool open the site to test it?
- Never. No request is made to the address being examined, no redirect is followed, no screenshot is produced and no image is loaded from that domain. This is a design choice: visiting a phishing link confirms to its author that the target exists, and may be enough to trigger whatever the link carries.
- What is a homoglyph, and what is Punycode?
- A homoglyph is a character whose shape imitates another's: the Cyrillic « а » against the Latin « a ». Punycode is the notation that allows a non-Latin domain to be written in ASCII characters: пример.рф is technically written xn--e1afmkfd.xn--p1ai. Punycode is not suspicious in itself — it is how internationalised domains normally work — but it is the channel deceptive characters travel through, so the tool always shows both forms.
- Is a domain written in Japanese, Russian or Arabic treated as dangerous?
- No, and that is an explicit design point. The tool applies the restriction levels of the Unicode UTS #39 standard, which distinguish a domain that is consistent in its script — perfectly legitimate — from a word that mixes two visually close scripts, such as Latin and Cyrillic. A domain written entirely in Japanese, Chinese, Russian or Arabic therefore comes back without an alert, with a simple « internationalised domain » note. It is the same boundary Chrome uses when deciding whether to display a domain in Unicode or in Punycode.
- What does « main domain » mean?
- It is the domain actually registered with a registry, the one that determines who owns the page. In paypal.com.security-check.example.net, the main domain is example.net: everything before it was chosen freely by the owner of example.net. The calculation relies on the Public Suffix List, which handles example.co.uk correctly and makes clear that a domain such as user.github.io is a subdomain provided by a hosting service.
- Does « no suspicious signal » mean the site is safe?
- No. It means the address shows none of the deception mechanisms the tool can recognise. The site's content is not examined, since it is not loaded. A fraudulent site can have a flawless address, on a freshly registered domain with an innocuous name. That is why the tool never states that a site is safe.
- Why are the displayed addresses not clickable?
- To prevent an accidental click from opening the very address you are checking. Every address and every domain shown in the result is plain text: you can select and copy them, not follow them.
- What data does the analysis rely on?
- On the confusable character tables and identifier statuses of the Unicode UTS #39 standard, and on the Public Suffix List for domains. This data is embedded in the page: it is neither downloaded on the fly nor queried remotely, and it is refreshed when the site is updated.
In short
How can I check whether a link is fraudulent without clicking it?
Copy the address without opening it — long press on mobile, right-click then « copy link » on a computer — then paste it into a URL analysis tool. ToolPilot's URL safety check examines the text of the address in your browser, without contacting the site: it isolates the domain actually registered, decodes internationalised domains, spots invisible characters or characters borrowed from another script, and explains every anomaly it finds.
Which signs give away a phishing address?
The most reliable are: a main domain different from the brand announced, a username placed before an @ character, mixed scripts inside a single word (a Cyrillic letter in a Latin word), an invisible character in the domain name, an IP address instead of a domain, and a stack of subdomains pushing the real domain off screen. The vocabulary used — « secure », « verify », « login » — is only a secondary clue: it appears in legitimate addresses too.