Free tool
Fake login page checker
A fake login page copies the look of a real sign-in screen to steal your username and password. Paste the link to any sign-in page below and we will open it in an isolated browser and look for the tell-tale signs of credential phishing.
Public http/https only. Private networks blocked. Never enter passwords in the sandbox. How it works
What makes a login page fake
Credential-phishing kits are cheap and convincing. They copy the logo, colours and wording of Microsoft, Google, Apple, PayPal, banks and delivery companies. What they cannot easily copy is the real domain and the real back-end. When the checked page contains a password field, our fake-login check looks for:
- Forms that send your login elsewhere – a sign-in form whose data goes to a different site, to a hidden
data:address, or to known form-collection services. - Borrowed branding – brand names, logos, page titles or favicons of well-known companies on a domain that does not belong to them.
- Obfuscated scripts – heavily encoded or scrambled JavaScript on the login page, often used to hide where the data goes.
- Brand-new domains – a login form on a domain registered only days ago, according to public RDAP registration data.
- No HTTPS – a password field on a page that is not served over a secure connection.
Every signal adds to the risk score. When several match, the report shows a clear Fake login page warning with the evidence. Official sign-in domains such as accounts.google.com or login.microsoftonline.com are recognised and not flagged just for having a login form.
More than one opinion
The fake-login heuristics run alongside the other checks in every report: Google Safe Browsing (is the address listed as phishing or malware?), VirusTotal (how many of 70+ security vendors flag the domain?), redirects, lookalike-domain patterns and the TLS certificate. You also get a screenshot of the page from our sandbox, so you can compare it with the real sign-in page without loading the suspicious one yourself.
Before you sign in anywhere
The safest login is one you start yourself. Use a bookmark, the official app, or type the address directly instead of following a link from a message. Password managers help too: they only fill your password on the exact domain it was saved for, so if yours does not offer to fill, stop and check the address. Turn on two-factor authentication, ideally with an authenticator app or security key. And never type a real password inside a sandbox or preview – including ours.
Want this warning without leaving the tab? The browser extension shows the same fake-login result in its popup.
Frequently asked questions
How can I tell if a login page is fake?
Check the full domain in the address bar first – fake pages live on domains that only resemble the real one. Then look for signs our checker tests automatically: forms that post to another site, borrowed logos on an unrelated domain, a very new domain or missing HTTPS.
Will the checker enter my password or test my account?
No. We never type anything into the page. We only load it in an isolated browser and inspect its code, forms and branding.
Why does a real login page sometimes show warnings?
Some legitimate sites send logins to a separate identity provider or use new domains. The report lists exactly which signals matched so you can judge, and official domains of major brands are recognised.
Does it work for pages that are not in English?
Yes. The checks look at the page structure, domains and branding, so they work for sign-in pages in any language.