Is this email phishing?
Paste the message body (and headers if you have them). The check runs entirely in your browser — nothing is uploaded, logged, or stored.
How this check works
It looks for the same recognizable patterns an analyst scans for first: manufactured urgency, requests to authenticate from inside the message, payment or banking changes, link obfuscation (shorteners, unusual TLDs, raw IPs), generic greetings, and high-risk attachment types. Each match adds weight to a score. It is a triage aid, not a verdict — a clean score never proves a message is safe.
Learn the terminology in the security glossary, or decode the delivery path with the email header decoder.
When people use this
"Your mailbox will be suspended"
Account-expiry threats are the most common phishing lure. The checker flags the urgency language plus the sign-in link that does not belong to your provider.
A supplier changed its bank details
Invoice and payment-redirect fraud costs organisations more than any other email attack. Paste the message before anyone touches the payment run.
A recruiter or delivery notice you did not expect
Consumer-targeted lures usually pair a plausible story with a lookalike domain and a shortened link — both get flagged.
Teaching someone what to look for
Trainers and IT teams paste real (redacted) examples so staff can see which specific words and links triggered the score.
Frequently asked
- Is this phishing checker really free?
- Yes. It runs entirely in your browser, needs no account, and there is no usage limit. Nothing you paste is uploaded or stored.
- Does a low score mean the email is safe?
- No. A low score only means none of the common phishing patterns matched. Targeted attacks can look perfectly ordinary, so treat the result as a triage aid and confirm any money or credential request through a channel you already trust.
- What does the checker actually look at?
- Manufactured urgency, requests to sign in from inside the message, payment or bank-detail changes, link obfuscation such as shorteners, unusual top-level domains and raw IP addresses, mismatched reply-to addresses, generic greetings, and risky attachment types.
- Can I check an email safely without opening links?
- Yes — that is the point. Copy the message text into the box instead of clicking anything. To go deeper on where the mail came from, paste the raw headers into the email header decoder.
- Should I report it if it looks like phishing?
- Report it to your IT or security team and delete it. If you already entered a password, change it immediately and tell IT so they can watch for sign-ins from unexpected locations.
Want the full AI verdict with next steps saved to your history? See what a paid account keeps, or start with the free alert analyser.