How confirmURL.com works

A plain-language walkthrough of what happens when you confirm a link.

1. You paste a URL

Start with a full https:// link from email, chat, SMS, or a shortened URL you do not trust yet.

2. Safety gates

We block private and internal network targets (for example localhost or cloud metadata addresses) to reduce server-side request risks. Only public http/https destinations are allowed.

3. Isolated browser session

For live checks, we open a headless Chromium-based browser that is not your personal profile. It does not use your passwords or cookies. Sessions are short-lived.

4. You review the result

You can view a screenshot or interact briefly to see redirects, branding, and forms. Never enter real credentials into a page inside the sandbox.

4a. More ways to check

Leitor de QR code — decodes the QR code in your browser (camera or photo; the image is never uploaded), then runs the normal safety check on the link. Wi-Fi, text and other non-link codes are shown but not opened.
Verificador de e-mail e SMS — paste a whole message. We extract every link (including defanged ones and links hidden behind HTML text), quick-check each domain without opening it, and flag scam tricks: urgency, requests for logins, codes, payments or gift cards, link text that doesn't match the real destination, and brand names that don't match the link domains. Your message text is processed in memory only and never stored (the links found are recorded in our admin-only check log, see Privacy).
Side-by-side compare — when a link looks like a lookalike of a known brand, the report shows its screenshot next to the brand's real page (official screenshots are refreshed every 24 hours).
Extensão para navegador - check the current tab or right-click any link (Chrome, Edge, Firefox), with optional warning badges on links (off by default).
API pública — GET /api/v1/check?url= returns the same verdict as JSON. Free keys, rate limited.
Golpes denunciados — links reported by visitors are reviewed by a moderator before they're published (link, verdict and date only).
Install as an app — on phones you can add confirmURL to your home screen and share links straight to it from other apps.

When the checked page has a login form, we look for signs that it is a fake sign-in page built to steal passwords:

password or sign-in forms that submit to a different site, to a hidden data: address, or to known data-collection services
brand names, logos, titles or favicons (PayPal, Microsoft, Apple, banks and more) on a domain that isn't the brand's own
obfuscated or encoded scripts on the login page
a login form on a brand-new domain (registration date from RDAP)
password fields on pages without HTTPS

Each sign adds to the risk score. When several line up, the report shows a Página de login falsa warning and a card listing the evidence. Official brand domains (for example accounts.google.com) are recognized and not flagged. The check runs on our server in milliseconds; nothing you type is involved. The browser extension shows the same warning in its popup.

4c. Threat-intelligence sources

Each safety check also uses data from two public reputation services:

Google Safe Browsing — Google's lists of known malware, phishing (social engineering), unwanted-software and harmful-app URLs. We send the link you entered and where it ended up; the report shows Limpo or Sinalizado with the threat type.
VirusTotal — aggregates verdicts from 70+ antivirus and URL-security vendors. We look up the site's domain and show how many vendors flag it, with a link to the full VirusTotal page.

To stay fast and within free-tier limits, results are cached (VirusTotal for 24 hours per domain, Safe Browsing for 6 hours). If a service is busy, the report says so instead of guessing. We also check domain age (RDAP), the TLS certificate, lookalike/brand-impersonation patterns and fake login pages. confirmURL is independent and not affiliated with or endorsed by Google or VirusTotal; a clean result is not a guarantee.

Ferramentas gratuitas para verificações específicas

Verificador de segurança de URL · Verificador de links de phishing · Verificador de links de golpe · Verificador de páginas de login falsas · Expandir um link curto · Verificador de links em QR code

5. You decide

If the final site looks wrong, close it and open the official app or type the brand’s address yourself. If it looks legitimate, still prefer official bookmarks for logins.

Try it now Read safety limits