How to check if a link is safe before you click
To check a link before you open it, find its domain: the name just before the first single slash, read from its end. That name, not the words in front of it and not the padlock, tells you whose site it is. If the link is shortened or hidden in a QR code, find out where it leads first, or look it up in a free checker such as Google Safe Browsing or VirusTotal. A clean result only means no known threat matched, so when a link asks you to pay or sign in, go to the official app or website yourself.
How to read a web address
Find the domain
Take https://login.yourbank.example/account?month=10:
- Skip
https://and read up to the first single slash:login.yourbank.example. - Read it from the end. The last two parts,
yourbank.example, are the domain, the name someone registered. Some endings have two parts of their own, such as.co.ukor.co.il, and then the domain is the last three parts. - Anything to the left, here
login., is a subdomain. Only the domain's owner can create one, so it is exactly as trustworthy as the domain. - Everything after the slash is the path and the parameters: which page to show, and what to show on it. They can contain any words at all.
Words in front, words after
Scammers put a familiar name where it does not count. In https://yourbank.com.account-check.example/login the domain is account-check.example, and yourbank.com
is a subdomain they made up. In https://account-check.example/yourbank/secure-login, the bank's name and the word secure
are only part of the path.
Look-alike domains
A fake domain is often one small change away from the real one:
- a swapped, missing or extra letter, or a digit for a letter:
yourbamk.example,yourbank1.example - an extra word:
yourbank-support.example,yourbank-refunds.example - a different ending, such as
.netor.cowhere the real site uses.com
Criminals also buy search ads for look-alike domains, the FBI has warned, so a top search result is not proof either.
Letters from other alphabets can look identical to Latin ones, like the Cyrillic а
and the Latin a
. Chrome shows such an address in a coded form starting with xn-- when it mixes alphabets suspiciously or imitates a well-known name, but a text or an email shows the letters as they are.
The padlock is about encryption, not trust
An address that starts with https, and the padlock next to it, mean the connection to the site is encrypted. They say nothing about who runs the site. The Federal Trade Commission points out that the s
does not mean a site is legitimate, and the FBI has warned that phishing sites use https to look secure. Check the domain instead.
How to see where a link goes without opening it
- On a phone, press and hold the link instead of tapping it. Most phones show the full address at the top of a menu or a preview. Read it, then close the menu.
- On a computer, rest the pointer on the link without clicking, and the real address appears, usually in a corner of the window. In an email, the visible text of a link can show one address and lead to another.
- Shortened links, from services such as Bitly or TinyURL, show only the shortening service. They have honest uses, but they hide the destination, so treat one as unknown.
- QR codes cannot be read at all until you scan them. Most phone cameras show the address before opening it; our guide to fake QR codes covers what to look for.
To learn where a shortened link ends up, use a service that follows it on its own servers and reports the final address, such as urlscan.io below.
Free tools for a manual check
Copy the link (press and hold it, then choose to copy it) and paste it into one of these, without opening it first.
Google Safe Browsing site status
The site status tool in Google's Transparency Report tells you whether a site currently contains content that Safe Browsing has determined to be dangerous
, in Google's words: malware, unwanted software or phishing. It is the service behind Chrome's red warning pages. It does not visit the page for you, cannot judge a site it has not seen, and does not expand shortened links.
VirusTotal
VirusTotal checks an address against more than 70 security vendors' scanners and block lists, according to its documentation, and shows how many flag it. One flag among many can be a false alarm; several are a clear warning. It is a sharing platform: reports are visible to the VirusTotal community, and its terms of service say not to send anything you do not want to share publicly.
urlscan.io
urlscan.io opens the link in a browser on its own servers and records what happens: the redirects, the final address, a screenshot and the domains the page contacts. Nothing loads on your device. A public scan can be found by anyone, and the urlscan.io FAQ says to choose public only when the address holds no personal or confidential data.
Before you paste a link anywhere
A link can carry personal information: an email address, an order number, or a token that signs you in or resets a password. A public checker can expose it to strangers, so if a link contains something personal, check just its domain.
Why a clean result is not a guarantee
- New sites. A scam site set up an hour ago may not be on any list yet, and scammers move to new domains all the time.
- Hacked sites. A real business's site can be broken into to host a scam page. Google defines hacked content as content placed on a site without permission through a security weakness. The domain is genuine, so the check may pass.
- Pages that show checkers something else. Some scam pages show a harmless page to checkers and search engines and the scam only to some visitors, a trick Google calls cloaking.
A red result is a reason to stop, but a green one is not permission. When a link asks for money, a password or a code, the safest check is to skip the link and go to the organization yourself.
Checking links with an app
Our Android app LinkShield is coming soon to Google Play. You share or paste a link into it, and it checks the link's structure for signs of risk and matches it against built-in lists of known phishing and malware sites, both on your phone. It also asks the Quad9 encrypted DNS service, and for Pro users Google Web Risk through a server we run that does not store the address. It sends no name, account or ad ID, does not read your messages, and the limits above apply to it too. For QR codes, our SafeScan QR scanner follows redirects and checks the link in a similar way.
| Where the link came from | What to check first | Safer route |
|---|---|---|
| Text message | Did you expect it, and is the domain exactly the organization's? | Open the organization's official app, or type its website yourself |
| The real address behind the link text, and the sender's domain | Sign in through a bookmark or the app, not the email | |
| QR code | A sticker over the code, and the address the camera shows | Pay at the machine, at the counter or in an app you already have |
| Chat or social media | Whether the friend really sent it, and where a shortened link leads | Ask the friend another way, such as a phone call |
| Search result or ad | The domain in the result, letter by letter | Type the address you know, or use a saved bookmark |
If you already clicked
Opening a page is usually not harmful by itself; what matters is what you did next. If you typed a password or card details, paid, shared a code or installed something, act quickly: call your bank or card issuer first, then change passwords and remove anything you installed. The full steps, in order, are in our guides to fake text messages and fake QR codes.
Then report it. In the United States, use ReportFraud.ftc.gov; in the United Kingdom, forward suspicious emails to report@phishing.gov.uk and scam texts to 7726. Our text message guide lists where to report in more countries. You can also report a phishing page to Google Safe Browsing.
Questions and answers
Is a link with https safe?
Not necessarily. Https means the connection is encrypted, but scam sites use it too. Whose site it is depends on the domain, not the padlock.
Can I check a link without clicking it?
Yes. Press and hold it on a phone, or hover over it on a computer, to see the full address and read the domain. To go further, paste it into one of the free checkers above.
Is it safe to paste a link into a link checker?
Pasting a link does not open it on your device. The risk is privacy: some checkers share or publish what you submit. Do not paste links that contain personal details, order numbers, or sign-in and password-reset tokens.
What is a shortened link?
A short address from a service such as Bitly or TinyURL that forwards you to a longer one. It hides the real destination, so check where it leads or reach the site another way.
A checker said the link is clean. Can I trust it?
A clean result only means no known threat matched at the time of the check. A new or hacked site may not be listed yet, so when a link asks for money, a password or a code, go to the site yourself.
How can I spot a fake link?
Look for a domain built to resemble a real one: a changed or added letter, an extra word such as support
or secure
, a different ending, or letters from another alphabet. Read the domain from its end, letter by letter.