How confirmURL.com works
A plain-language walkthrough of what happens when you confirm a link.
1. You paste a URL
Start with a full https:// link from email, chat, SMS, or a shortened URL you do not trust yet.
2. Safety gates
We block private and internal network targets (for example localhost or cloud metadata addresses) to reduce server-side request risks. Only public http/https destinations are allowed.
3. Isolated browser session
For live checks, we open a headless Chromium-based browser that is not your personal profile. It does not use your passwords or cookies. Sessions are short-lived.
4. You review the result
You can view a screenshot or interact briefly to see redirects, branding, and forms. Never enter real credentials into a page inside the sandbox.
4a. More ways to check
- QR code scanner — decodes the QR code in your browser (camera or photo; the image is never uploaded), then runs the normal safety check on the link. Wi-Fi, text and other non-link codes are shown but not opened.
- Email & SMS scanner — paste a whole message. We extract every link (including defanged ones and links hidden behind HTML text), quick-check each domain without opening it, and flag scam tricks: urgency, requests for logins, codes, payments or gift cards, link text that doesn't match the real destination, and brand names that don't match the link domains. Your message text is processed in memory only and never stored (the links found are recorded in our admin-only check log, see Privacy).
- Side-by-side compare — when a link looks like a lookalike of a known brand, the report shows its screenshot next to the brand's real page (official screenshots are refreshed every 24 hours).
- Browser extension - check the current tab or right-click any link (Chrome, Edge, Firefox), with optional warning badges on links (off by default).
- Public API —
GET /api/v1/check?url=returns the same verdict as JSON. Free keys, rate limited. - Scam feed — links reported by visitors are reviewed by a moderator before they're published (link, verdict and date only).
- Install as an app — on phones you can add confirmURL to your home screen and share links straight to it from other apps.
4b. Fake login page detection
When the checked page has a login form, we look for signs that it is a fake sign-in page built to steal passwords:
- password or sign-in forms that submit to a different site, to a hidden
data:address, or to known data-collection services - brand names, logos, titles or favicons (PayPal, Microsoft, Apple, banks and more) on a domain that isn't the brand's own
- obfuscated or encoded scripts on the login page
- a login form on a brand-new domain (registration date from RDAP)
- password fields on pages without HTTPS
Each sign adds to the risk score. When several line up, the report shows a Fake login page warning and a card listing the evidence. Official brand domains (for example accounts.google.com) are recognized and not flagged. The check runs on our server in milliseconds; nothing you type is involved. The browser extension shows the same warning in its popup.
4c. Threat-intelligence sources
Each safety check also uses data from two public reputation services:
- Google Safe Browsing — Google's lists of known malware, phishing (social engineering), unwanted-software and harmful-app URLs. We send the link you entered and where it ended up; the report shows Clean or Flagged with the threat type.
- VirusTotal — aggregates verdicts from 70+ antivirus and URL-security vendors. We look up the site's domain and show how many vendors flag it, with a link to the full VirusTotal page.
To stay fast and within free-tier limits, results are cached (VirusTotal for 24 hours per domain, Safe Browsing for 6 hours). If a service is busy, the report says so instead of guessing. We also check domain age (RDAP), the TLS certificate, lookalike/brand-impersonation patterns and fake login pages. confirmURL is independent and not affiliated with or endorsed by Google or VirusTotal; a clean result is not a guarantee.
Free tools for specific checks
URL safety checker · Phishing link checker · Scam link checker · Fake login page checker · Unshorten a URL · QR code link checker
5. You decide
If the final site looks wrong, close it and open the official app or type the brand’s address yourself. If it looks legitimate, still prefer official bookmarks for logins.