Free Tool

Free Link Safety Checker - Is This Link Safe?

Free link safety checker: paste any URL, see every redirect hop, and get a verdict on the final destination from threat-intelligence DNS, PhishTank, domain age, and phishing heuristics. No signup.

Paste a link to check

The link is expanded first, then only the final destination is checked. Short links and redirects are never a flag on their own.

No signup required

Free forever

GDPR compliant

Quick Answer

A link safety checker tells you whether a URL is known to be malicious before you open it. This one expands the redirect chain first, then checks only the final destination against Cloudflare's 1.1.1.2 threat-intelligence DNS, the PhishTank phishing database, the domain's registration age, and eight phishing heuristics - and shows exactly what was checked.

Quick Facts

Short links and redirects are followed (up to 15 hops) and only the final destination is judged - a shortener is never a red flag by itself.
Cloudflare's 1.1.1.2 resolver answers 0.0.0.0 for hostnames its threat intelligence classifies as malware or phishing; the tool compares it with the plain 1.1.1.1 answer.
PhishTank, run by Cisco Talos since the OpenDNS acquisition, only lists a URL as a phish after community members have independently verified it.
Domain age comes from RDAP, the IETF protocol that replaced WHOIS; ICANN required gTLD registrars to switch off port-43 WHOIS in January 2025.
Eight browser-side heuristics run on the destination: HTTPS, raw IP host, punycode or mixed-script hostname, brand lookalike, deceptive keyword on a young domain, subdomain depth, an @ in the URL, and long encoded payloads.
Every provider reports clean, flagged, or not checked - a timeout is shown as not checked instead of being counted as clean.
The verdict is Malicious, Caution, or No known threats. It never says a link is 100% safe, because no database can.

How to check if a link is safe

Paste, expand, read the verdict, then decide.

1
Paste the link
Drop in the URL exactly as you received it - a bit.ly, u2l.ai, t.co, or any full address. Paste from an email, SMS, QR scan, or chat message. Then click Check link.
2
Read the redirect chain
The tool follows every HTTP redirect (301, 302, 307, 308) and lists each hop with its status code. Short-link hops are labelled neutrally. The last hop is the page you would actually land on.
3
Review the verdict and provider rows
The final destination is checked against Cloudflare threat DNS, PhishTank, and RDAP registration age. Each row says clean, flagged, or not checked. A single flagged source produces a Malicious verdict.
4
Scan the heuristics
Eight structural checks run on the destination URL. Each fired check has a one-line reason. Two or more fired checks, or a deceptive keyword on a domain under 30 days old, produce a Caution verdict.
5
Decide, then shorten if you want
Open the link only when the verdict and the domain both make sense for the sender. If you plan to share a clean destination, shorten it with U2L, which screens every destination before it issues a short link.

What is a Link Safety Checker?

Link Safety Checker is a URL scanner that looks up a link's final destination in threat-intelligence sources and inspects the address for phishing patterns, so you know whether it is safe to click before you open it. Unlike a browser warning, it works on links you have not visited yet - from email, SMS, chat, or a QR code.

Most phishing today does not arrive as a raw malicious domain. It arrives wrapped: a short link, a tracking redirect from a marketing platform, an open redirect on a trusted site, or a QR code that hides the URL entirely. A checker that only looks at the address you paste is looking at the wrapper. This tool follows the wrapper to the end, then evaluates the page you would actually reach. That distinction matters because the FBI's Internet Crime Complaint Center reported phishing and spoofing as the most reported crime category in its 2024 Internet Crime Report, and nearly all of it starts with a link.

The verdict is built from three kinds of evidence. Reputation data says whether someone has already caught this destination doing harm: Cloudflare's security resolver sinkholes hostnames its threat feeds classify as malware or phishing, and PhishTank publishes URLs that its community has reviewed and confirmed. Registration data says how old the domain is, because phishing domains are typically registered days before a campaign and abandoned weeks after. Structural heuristics say whether the URL itself looks like the tricks phishers use - a brand name inside a domain that is not the brand's, Cyrillic letters standing in for Latin ones, a login keyword on a two-week-old domain.

What a link safety checker cannot do is prove a link is harmless. Reputation databases only contain what has been reported, so a phishing page created an hour ago will pass every lookup. That is why the best result this tool gives is No known threats, listed alongside exactly what was checked and when, rather than a green checkmark that implies certainty it does not have. Read the redirect chain and the destination domain yourself; the tool is there to make that reading fast and informed.

How does a Link Safety Checker work?

Step one is expansion. The URL is sent to U2L's stateless expand endpoint, which issues a GET with redirects disabled and records each response. When the status is 301, 302, 303, 307, or 308 and a Location header is present, it resolves that header against the current URL (relative Location values are allowed by RFC 9110) and repeats, up to 15 hops with a 5-second timeout on the first request and 3 seconds on each subsequent one. A 3xx response without a Location header is inspected for a meta-refresh or anchor target. The hop list you see is that chain verbatim: URL, status code, and milliseconds per hop. JavaScript redirects on a 200 page are not executed, so a page that redirects via script is shown as the destination.

Step two is reputation, and it runs only on the last hop. The hostname is resolved twice over DNS-over-HTTPS: once at cloudflare-dns.com (the plain 1.1.1.1 resolver) and once at security.cloudflare-dns.com (the 1.1.1.2 resolver). The 1.1.1.2 service returns 0.0.0.0 instead of the real address for hostnames in Cloudflare's malware and phishing threat feeds. The tool reports blocked only when the plain resolver returned real A records and the security resolver returned nothing but 0.0.0.0. A hostname that does not resolve at all is reported as not checked, never as blocked. In parallel, the full URL is submitted to PhishTank's checkurl API; a URL that is in the database and marked valid is a phish, one that was submitted but rejected by reviewers is treated as clean, and any HTTP error or timeout (6 seconds) is reported as not checked.

Step three is registration age. The registrable domain (example.co.uk, not sub.example.co.uk) is looked up through rdap.org, the IETF-standard RDAP bootstrap service that replaced WHOIS for generic TLDs. The registration event date is converted to an age in days. Some country-code TLDs do not publish RDAP, in which case the age row shows not available and the age-dependent heuristics simply do not fire. Nothing from any of these lookups is stored; the API is a pass-through with a five-minute cache header so a repeated check of the same link does not hammer the providers.

Step four runs in your browser. The destination URL is parsed with the native URL API, which also converts any internationalized hostname to punycode, so xn-- labels are visible even if the original link showed Unicode. Eight heuristics then evaluate the hostname and path: scheme is not HTTPS; hostname is a bare IPv4 or IPv6 address; hostname contains an xn-- label or mixes Latin with Cyrillic or Greek letters; a well-known brand token (paypal, microsoft, netflix, and others) appears in a hostname whose registrable domain is not that brand's; a deceptive word such as login, verify, secure, or wallet appears in the hostname of a domain registered fewer than 90 days ago; the hostname has more than four labels; the URL carries a username before an @; or the URL is unusually long and contains a base64-looking payload. The final verdict combines all three steps: Malicious if either reputation source flagged the destination, Caution if two or more heuristics fired or a deceptive keyword sits on a domain under 30 days old, otherwise No known threats.

Use Cases

How marketers, businesses, and developers use link safety checker.

Checking a link from an unexpected email

A delivery notice, invoice, or password-reset email you did not ask for is the classic phishing vector. Paste the button's URL here before clicking. The redirect chain shows whether the tracking link lands on the real sender's domain, and the brand-lookalike heuristic catches hostnames like microsoft-account-verify.com that a glance would miss.

Verifying a short link before you tap it

Short links hide their destination by design, which is why people hesitate to open them. Paste the bit.ly, t.co, or u2l.ai link and the tool expands it to the final page and judges that page - never the shortener itself. Pair with /tools/url-expander when you only want the destination without the safety checks.

Scanning a QR code destination

QR phishing (quishing) works because you cannot read a QR code with your eyes. Scan the code with /tools/qr-code-scanner, copy the decoded URL, and check it here before visiting. Parking meters, restaurant tables, and posters are common places for a malicious sticker placed over the real code.

Screening links in SMS and chat messages

Smishing texts (a missed parcel, a toll fee, a bank alert) use fresh domains that will not be in any blocklist yet. The RDAP age row and the deceptive-keyword heuristic are built for exactly this case: a domain registered nine days ago with secure or verify in the name gets a Caution verdict even when every database says clean.

Moderating user-submitted links

Community managers and forum moderators receive links from strangers all day. Run each one here to see where it really goes and whether it is already on a threat list. For a batch of links, expand them first with /tools/bulk-url-checker to find the final destinations, then spot-check the suspicious ones individually.

Auditing affiliate and sponsor links

Affiliate networks chain three or four redirects before the merchant page, and a compromised network can inject a hop. Reading the chain hop by hop shows every intermediate domain and status code, so you can confirm the path ends at the merchant you expect and not at a lookalike.

Training staff to read redirect chains

Security awareness sessions land better with a live example than a slide. Paste a real phishing sample and walk the team through the chain, the hostname labels, and the verdict rows so they learn what a laundered link looks like and why a shortener alone is not the problem.

Checking a login page before entering credentials

If a page asks for a password, check its URL first. The tool shows whether the hostname's registrable domain is really the brand's, whether it uses punycode, and how old the domain is. A legitimate sign-in page for a major service will not live on a 12-day-old domain.

Screening links before shortening and sharing them

Marketers who shorten links for campaigns should check the destination first, because a short link that leads to a compromised page damages the brand that shared it. Check here, then shorten with U2L, which independently screens every destination before creating a short link and re-screens on edit.

Link Safety Checker vs Alternatives

Side-by-side feature and pricing comparison with the top alternatives.

Feature	NordVPN Link Checker	Avast Link Checker	Security.org URL Checker
Free, no signup
Shows the full redirect chain with status codes
Names each data source in the result	Partial	Partial
Shows domain registration age
Lists every heuristic checked, fired or not
Reports a timed-out source as not checked	Varies	Varies	Varies
Proprietary machine-learning detection			Varies
Shorteners treated as neutral	Varies	Warns	Varies

Link Safety Checker vs NordVPN Link Checker

NordVPN's checker compares a URL against its own intelligence database and runs a proprietary machine-learning model trained to spot zero-day phishing pages, and it can explain a scam warning in plain language. That model is a real advantage for brand-new phishing pages that no public database has seen, and NordVPN has telemetry from millions of devices to train it on.

What it does not show is its work. You get a verdict, not the redirect chain, not the domain age, and not which signal drove the result. This tool takes the opposite approach: every source is named, every heuristic is listed whether it fired or not, and the chain is printed hop by hop, so you can reach your own conclusion about a link that a database has not caught yet.

Link Safety Checker vs Avast Link Checker

Avast's page draws on Avast's own threat database plus Google Safe Browsing and Microsoft SmartScreen, and it answers a broad FAQ on scams, fake shops, and payment safety. It also correctly advises expanding a short URL before trusting it, and it cross-references Trustpilot and the Better Business Bureau for shop legitimacy.

Its output is a single rating. It does not expand the link for you, does not show registration age, and treats shortened URLs as a risk category in the FAQ rather than expanding them. Here, expansion is the first step and shorteners are neutral by rule; the only thing judged is the final destination, which is the only thing that can hurt you.

Best Practices

Judge the last hop, not the first

A short link, a marketing tracker, and an open redirect are all wrappers. The page that can steal a password is the final destination. Read the last hop's hostname and its registrable domain, and ignore how many hops it took to get there.

Read the registrable domain from the right

The registrable domain is the last two labels (or three for suffixes like co.uk). In login.paypal.com.secure-check.net the registrable domain is secure-check.net, not paypal.com. Phishers rely on you reading from the left.

Treat No known threats as exactly that

The verdict means no database had this destination and no heuristic fired at the time shown. It is not a guarantee. If the sender, the message, and the domain do not fit together, do not open the link regardless of the verdict.

Weight domain age heavily for money and logins

Banks, payment providers, and delivery companies do not run sign-in pages on domains registered last month. A young domain plus a financial or login context is enough reason to type the company's real address into your browser instead.

Check punycode with the converter

When the hostname shows an xn-- label, paste it into /tools/punycode-converter to see the Unicode form. A hostname that renders as a familiar brand but encodes to xn-- is a homoglyph attack.

Re-check links that were clean last week

Reputation changes. A domain that was clean can be compromised, and a phishing page reported yesterday appears in PhishTank today. The checkedAt timestamp is there so you know how fresh the result is; re-run before resharing an older link.

Screen before you shorten

If you distribute links, check destinations before wrapping them. U2L screens every destination when a short link is created and again when it is edited, but a checker like this one lets you see the evidence yourself first.

Report what you find

A confirmed phishing page that is not yet in PhishTank helps nobody until it is reported. Submit it at phishtank.org and through your browser's report-phishing option so the next person's checker catches it.

Common Mistakes to Avoid

Treating a shortener as the threat

bit.ly, t.co, and u2l.ai links are used by newspapers, banks, and governments. A short link is a wrapper, not a signal. Expand it and judge the destination; flagging every short link trains people to ignore warnings.

Trusting the padlock

HTTPS only means the connection to the server is encrypted. Certificate authorities issue free certificates to phishing domains within minutes, so most phishing pages have a padlock. Missing HTTPS is a flag; present HTTPS proves nothing.

Reading the hostname from the left

apple.com.id-verify.info looks like Apple if you stop reading early. The registrable domain is id-verify.info. Always find the last two or three labels before deciding who owns the page.

Assuming a clean database result means safe

PhishTank and DNS threat feeds are populated by reports and analysis, both of which take time. A phishing kit deployed this morning passes every lookup. Combine the reputation rows with the age and heuristics rows.

Ignoring an intermediate hop on a trusted domain

An open redirect lets a phisher build a link that starts on a real company's domain and hops elsewhere. The first hop being legitimate is what makes the attack work. Read the chain to the end.

Checking the link after clicking it

Once a page loads, it may already have prompted a download or captured a keystroke. Check first. If you have already clicked, close the tab, do not enter anything, and change any password you typed.

Technical Specifications

Redirect expansion	Up to 15 HTTP hops (301/302/303/307/308), 5 s first hop, 3 s per later hop
Reputation sources	Cloudflare 1.1.1.2 security DNS (DoH), PhishTank checkurl API
Domain age	RDAP via rdap.org; registrable domain; some ccTLDs unavailable
Provider timeout	6 s per source; a timeout is reported as not checked
Heuristics	8 structural checks run in the browser on the final destination only
Verdicts	Malicious, Caution, No known threats - never a safety guarantee
Shorteners	Neutral by rule - never a flag for redirects or short domains
Storage	Nothing stored; provider results cached at the edge for 5 minutes
Scope	Public http(s) URLs only; private and internal addresses are refused

Frequently Asked Questions

How does a link safety checker know if a link is safe?

It looks the destination up in threat databases (here, Cloudflare's 1.1.1.2 malware and phishing feed and PhishTank's verified phishing list), checks how recently the domain was registered, and inspects the URL for phishing patterns such as brand lookalikes and punycode. It can confirm a link is known-bad; it can only say a link has no known threats, never that it is guaranteed safe.

Is this link safe if the checker says No known threats?

It means no source flagged the final destination and no heuristic fired at the time shown. New phishing pages take hours to days to reach any database. Combine the verdict with context: does the domain match the sender, is it older than a few weeks, and did you expect the message? If any answer is no, do not open it.

Does the URL checker follow short links and redirects?

Yes. It follows up to 15 HTTP redirects and shows each hop with its status code, then checks only the final destination. Short-link hops are labelled neutrally. Redirects that happen in JavaScript on a 200 page are not executed, so that page is shown as the destination.

Why is a shortened link not flagged as suspicious?

Because a shortener is a wrapper, not a destination. Governments, banks, and newsrooms use short links every day. Flagging them would bury real warnings in noise. The tool expands the short link and judges the page it lands on - that is the only thing that can harm you.

What is Cloudflare 1.1.1.2 and what does blocked mean?

1.1.1.2 is Cloudflare's security DNS resolver. For hostnames that Cloudflare's threat intelligence classifies as malware or phishing, it answers 0.0.0.0 instead of the real IP, so the browser cannot connect. Blocked here means the plain 1.1.1.1 resolver returned real addresses and 1.1.1.2 sinkholed the same hostname.

What is PhishTank?

PhishTank is a community phishing database launched by OpenDNS in 2006 and now operated by Cisco Talos. Anyone can submit a suspected phishing URL; it is only marked valid after other members independently verify it. A flagged result here links to the PhishTank detail page for that submission.

Why does domain age matter for phishing link detection?

Phishing domains are usually registered days before a campaign and dropped weeks after, because blocklists catch up. A domain under 30 days old hosting a login or payment page is a strong signal on its own. The age comes from RDAP registration data, the protocol that replaced WHOIS.

What is a punycode or homoglyph link?

Internationalized domain names let hostnames contain non-Latin letters. Some Cyrillic and Greek letters look identical to Latin ones, so аpple.com with a Cyrillic а renders like the real brand but encodes as xn--80ak6aa92e.com. The tool flags any xn-- label or mixed-script hostname; /tools/punycode-converter shows the Unicode form.

What is an open redirect and why does it matter?

An open redirect is a page on a legitimate site that forwards visitors to any URL passed in a parameter like ?url= or ?next=. Phishers use it so the link starts on a trusted domain. Reading the full redirect chain exposes the real destination, which is why the chain is shown before the verdict.

How is this different from a URL expander or redirect checker?

/tools/url-expander and /tools/redirect-checker show where a link goes and how; they do not judge the destination. This safe link checker does both: it expands the chain, then runs reputation, age, and heuristic checks on the last hop. Use the expander when you only need the destination.

How does this compare to Google Safe Browsing or VirusTotal?

Google Safe Browsing and VirusTotal aggregate large commercial threat feeds and are excellent for known-bad URLs. This tool uses keyless public sources plus transparent heuristics and domain age, and it shows the redirect chain, which those services do not. Running both on a suspicious link is reasonable.

Why does a provider row say not checked?

The source timed out (6 seconds), returned an error, or the hostname did not resolve. Rather than counting an unanswered lookup as clean, the tool reports it honestly. Run the check again in a moment; if it persists, rely on the other rows and the heuristics.

The checker says Caution but the site looks legitimate. What now?

Caution means two or more heuristics fired or a deceptive keyword sits on a very young domain. Some legitimate sites trip heuristics, for example a new startup with login in its hostname. Read which rows fired. If the registrable domain is genuinely the company you expect, the site is likely fine.

The link could not be expanded. Can it still be checked?

If the destination refuses connections or times out, the redirect chain cannot be followed, so reputation and heuristics run on the address as entered and a note explains that. A link that is unreachable at check time may be a taken-down phishing page or simply a server that blocks automated requests.

What should I do if I already clicked a phishing link?

Close the page and do not enter anything. If you typed a password, change it on the real site and on any site where you reused it, and turn on two-factor authentication. If you downloaded a file, run an antivirus scan. Report the URL to PhishTank and your browser's phishing report so others are warned.

Is my link uploaded or stored?

The link is sent to U2L's stateless expand and link-safety endpoints so the redirect chain and provider lookups can happen server-side (browsers cannot make those calls directly). Nothing is stored; responses carry a short edge cache header only. The heuristics run entirely in your browser.

Is the link safety checker free?

Yes. It is free with no signup and no daily limit beyond normal rate limiting on the public endpoints. The reputation sources are keyless public services, so there is no plan gate.

Does U2L check links it shortens?

Yes. Every destination submitted to U2L is screened before a short link is issued and screened again when the destination is edited, so a u2l.ai link cannot be created for a known phishing or malware page. You can still run any u2l.ai link through this checker like any other URL.

Related Free Tools

WhatsApp Link Generator

Create wa.me click-to-chat links with prefilled messages. Add to your bio, ads, or QR codes for instant WhatsApp customer chats.

OG / Metatag Checker

Inspect Open Graph and Twitter Card tags for any URL. Preview link cards on Facebook, X, LinkedIn, and Slack before publishing.

Redirect Checker

Trace the full redirect chain of any URL. See every hop, status code, response time, and final destination.

URL Encoder / Decoder

Encode or decode any URL. Handle special characters, query strings, and percent-encoding. Pure browser, instant.

Schema Markup Generator

Generate valid JSON-LD schema for FAQ, HowTo, Article, Product, and Organization. Boost rich results and AI Overview citations.

URL Expander

Reveal the full destination behind any shortened URL. Check where a short link leads before clicking it.

See all 50 free tools

Key Terms

Phishing: A message and page designed to trick a person into entering credentials or payment details on a site controlled by the attacker, usually by impersonating a trusted brand.
DNS sinkhole: A resolver that answers a harmless address (0.0.0.0 in Cloudflare's case) for a hostname on a threat list, so the connection never reaches the malicious server.
Registrable domain: The part of a hostname a person can register: the label just before the public suffix, such as example.com or example.co.uk. Everything to its left is a subdomain the owner controls.
Homoglyph: A character that looks like another, such as Cyrillic а and Latin a. Homoglyph domains render like a real brand but encode to a different punycode hostname.
Open redirect: A page that forwards to any URL supplied in a query parameter, letting an attacker build links that start on a trusted domain and end on theirs.
RDAP: Registration Data Access Protocol, the IETF JSON-based replacement for WHOIS. It provides a domain's registration date, from which the tool computes domain age.

Share links people can trust

Every destination shortened with U2L is screened for phishing and malware before the short link is issued, and re-screened when it changes. Sign up free for branded short links, QR codes, and click analytics on links that pass the same checks you just ran.