Loading URL Safety Inspector…
Nothing here is visited. The link is taken apart as text in this tab — no request is made, no name is resolved and nothing is sent to us. That means this can tell you what a link is built to look like, and it cannot tell you whether the page at the end of it is malicious. Both halves of that sentence matter.
Paste a link above. It is read, not followed.
Parsing is the browser’s own URL parser, so the host shown here is the host the browser would use — not a guess from a regular expression that a crafted authority could fool. Component names follow RFC 3986; the userinfo it deprecates in §3.2.1 is still accepted by every browser, which is what makes the credentials trick work. Host characters are checked against the Unicode confusables data this site also uses for its homoglyph detector.
The part of a link that decides where it goes is the authority, and the authority ends at the first slash. Everything before an at sign inside it is a username and password rather than a destination, which is the trick behind a link that opens with a name you trust and lands somewhere you do not. Everything to the left of the final labels is a subdomain, chosen freely by whoever owns those final labels.
Paste a link and it is split into scheme, credentials, host, port, path, query and fragment, with a note on each saying what it actually controls. Nothing about that requires guessing: the parsing here is the same URL parser your browser uses, so the host reported is the host the request would be sent to, rather than whatever a regular expression thought it saw.
Plenty of links carry another link inside them. Sign-in flows, click trackers and image proxies all take a destination as a parameter, and a site that forwards to whatever it is handed is an open redirect: the link starts at a domain with a good reputation and a valid certificate, and ends anywhere at all. Percent-encoding the inner address hides it from a glance without hiding it from the browser.
Any parameter whose value parses as an address is pulled out here and its host reported separately, encoded or not. A path-only value is shown too, because a redirect that only accepts paths is still a way to make a link look like it goes somewhere it does not.
This tool makes no request. It does not fetch the page, follow a shortener, resolve the name or ask any third party about it. That is a deliberate limit with two reasons behind it: fetching a link somebody sent you turns a browser tab into a scanner aimed at a host you do not own, and it would mean sending somebody else’s address to us, which this site promises not to do.
The honest consequence is worth stating plainly. Everything here is about how the link is written, so it can show you a link built to deceive and it cannot tell you that an ordinary-looking address serves malware. A shortened link is opaque for the same reason: expanding it means asking the shortening service, and asking is a request.
Some findings come from a document — credentials in the authority are the deprecated userinfo component of the URI standard, and an xn-- label is punycode. Most are judgement: that an explicit port is worth a second look, that a brand name appearing as a subdomain deserves a mention, that five labels is more than a normal address needs. Each finding says which of the two it is, because a citation attached to an opinion is worse than no citation.
One limit shapes the ownership question. Working out where a domain stops and its registry begins needs the public suffix list, which this tool does not ship, so it reports the last two labels and tells you when that answer is one label short — on a name under a two-part suffix, the owner boundary sits further left than it looks.
Not automatically, but it means everything you send and receive can be read and modified in transit by anyone on the path. For anything with a login, a payment or a download, treat it as a reason to stop rather than a detail.
It means the connection is encrypted and the certificate matches the name in the bar. It says nothing about who owns that name, and certificates are free, so a convincing lookalike domain will show exactly the same padlock as the real one.
Ordinary web traffic uses the default for its scheme, so a link naming a port is pointing at something running beside the normal server — a development build, an administrative interface, or a service on a machine whose owner has no idea it is being linked to.
No, because that would mean making a request to the shortening service, and this tool makes none. Several services will show you the destination of their own links, and some shorteners reveal it if you add a character to the address.