How to Check if a Link Is Safe Before Clicking: The 2026 Guide

Every day, billions of links flow through emails, text messages, social feeds, and chat apps. Most are harmless. Some are not. A single click on a malicious URL can hand attackers your passwords, drain your bank account, or install ransomware on your device. Learning how to check if a link is safe before clicking is one of the most valuable digital skills you can build in 2026.

This guide walks through the practical steps, free tools, and warning signs used by security professionals to verify links quickly. Whether you received a suspicious shortened URL, an unexpected invoice link, or a message from a "friend" that feels off, you'll finish this article knowing exactly how to inspect it safely.

Why Checking Links Before You Click Matters

Link-based attacks are the number one delivery method for phishing, credential theft, and malware. Attackers rely on speed and trust: they want you to click before you think. According to industry reports, more than 90% of successful cyberattacks begin with a malicious link or attachment delivered through email or messaging.

The consequences of clicking a bad link include:

• Credential theft through fake login pages that mimic banks, email providers, or workplace portals.
• Drive-by malware downloads that install spyware, keyloggers, or ransomware without a visible prompt.
• Session hijacking where an attacker steals your logged-in cookies.
• Financial fraud via fake payment pages or crypto drainer contracts.
• Doxxing and tracking through links that reveal your IP address, location, or device fingerprint.

Warning Signs of an Unsafe Link

Before you use any tool, train your eye to spot red flags in the URL itself. Most malicious links carry visible clues if you know where to look.

1. Misspelled or Look-Alike Domains

Attackers register domains that resemble trusted brands: paypa1.com, arnaz0n.com, microsft-login.com, or faceb00k-security.net. Read the domain letter by letter, especially the section immediately before the first single slash.

2. Suspicious Subdomains

The real domain is always the part directly to the left of the top-level domain (.com, .net, .org). In paypal.com.secure-login.ru, the actual domain is secure-login.ru, not PayPal. Attackers stack legitimate-sounding words as subdomains to trick you.

3. Unusual Top-Level Domains

Banks, governments, and major brands rarely use TLDs like .zip, .mov, .top, .xyz, or .click for critical services. These are cheap and heavily abused by scammers.

4. URL Shorteners Without Context

Shortened links from bit.ly, tinyurl, or other services hide the destination. Shorteners are legitimate tools, but a shortened link in an unexpected message deserves extra scrutiny. Reputable shorteners like Lunyb offer link previews and safety checks precisely to solve this problem.

5. Excessive Characters, Numbers, or Encoding

URLs stuffed with random strings, percent-encoded characters (%20%2F), or hex sequences are often designed to hide the real destination from filters.

6. Urgency and Emotional Bait

Any link paired with "Your account will be closed in 24 hours," "You won a prize," or "Unauthorized login detected" is trying to bypass your judgment. Slow down.

How to Check if a Link Is Safe: A Step-by-Step Process

Follow this sequence any time you're uncertain about a URL. It takes under two minutes and catches the vast majority of threats.

1. Hover, don't click. On desktop, hover your cursor over the link to see the real destination in the bottom-left of your browser or email client. On mobile, press and hold (don't tap) to preview the URL.
2. Read the domain carefully. Identify the true domain using the rule described above. Look for misspellings, extra hyphens, or unusual TLDs.
3. Expand shortened URLs. Paste the short link into an expander tool (see below) to reveal the final destination without visiting it.
4. Scan with a URL reputation checker. Run the link through at least one automated scanner like Google Safe Browsing, VirusTotal, or URLVoid.
5. Verify with the source directly. If the link claims to be from your bank, employer, or a friend, contact them through a known channel (not by replying to the message).
6. Open in a sandbox if you must. If you still need to view the page, open it in an isolated browser session, a virtual machine, or a service like urlscan.io that visits the page for you.

Best Free Tools to Check a Link's Safety

The tools below are free, browser-based, and require no installation. Bookmark two or three so you can check suspicious links in seconds.

Tool	What It Does	Best For
Google Safe Browsing	Checks a URL against Google's constantly updated blocklist of phishing and malware sites.	Quick reputation check for any URL.
VirusTotal	Scans the link with 70+ security engines and shows historical data.	Deep analysis of unknown or suspicious links.
urlscan.io	Loads the page in a sandbox and screenshots it, showing all domains contacted.	Seeing what a page actually does without visiting it yourself.
URLVoid	Aggregates results from 30+ blocklist services and shows domain age.	Verifying newly registered or unfamiliar domains.
PhishTank	Community-driven database of confirmed phishing URLs.	Confirming a link is a known phishing attempt.
CheckShortURL / Unshorten.it	Expands shortened URLs to reveal the final destination safely.	Any bit.ly, tinyurl, or similar short link.

How to Use VirusTotal in 30 Seconds

1. Copy the suspicious link (right-click, then "Copy link address"—do not click it).
2. Go to virustotal.com and select the "URL" tab.
3. Paste the link and press Enter.
4. Review the results: green means clean across most engines, red flags mean stop.
5. Check the "Details" and "Community" tabs for extra context.

How to Check Links on Mobile Devices

Mobile browsers and messaging apps make it harder to see full URLs, but the process is still doable.

iOS (iPhone / iPad)

• Press and hold the link in Safari, Mail, or Messages. A preview card shows the full destination URL.
• Use the built-in "Copy Link" option to paste it into a scanner.
• Enable Safari's "Fraudulent Website Warning" in Settings > Safari.

Android

• Long-press the link to reveal the full URL in a popup.
• Use Chrome's built-in Safe Browsing (enabled by default in Settings > Privacy and security).
• Consider a browser like Brave or Firefox Focus that blocks trackers and known malicious domains.

Special Case: Checking Shortened URLs

Shortened links are convenient but opaque. A shortened URL could point anywhere, and you can't tell the destination just by looking at it.

Safe Ways to Reveal a Short Link

1. Paste the short URL into CheckShortURL.com or Unshorten.it—they follow the redirect chain and show you the final page.
2. Some shorteners let you preview by adding a symbol to the end of the URL. For example, appending + to a bit.ly link often shows a preview page.
3. Use urlscan.io to see the fully rendered destination page in a sandbox.

If you regularly send links yourself, choosing a shortener that offers built-in safety features matters. Our 2026 buyer's guide to URL shorteners compares services on transparency, malware scanning, and preview options. Reputable providers scan destination pages for phishing signatures and disable links that turn malicious.

How to Spot a Fake Login Page

Even if a link passes automated scanners, the landing page itself could be a well-crafted clone. Use these checks before entering any credentials.

1. Check the padlock and the domain. HTTPS alone does not mean safe—scammers easily get free certificates. Confirm the domain is exactly correct.
2. Look for design inconsistencies. Blurry logos, awkward spacing, outdated branding, or missing footer links are common giveaways.
3. Test with a fake password. Type an obviously wrong password. Real login pages reject it; many phishing pages accept anything and then redirect you.
4. Never enter credentials via a link. Instead, open a new tab and type the site's address manually or use a saved bookmark.
5. Use a password manager. Reputable password managers auto-fill only on domains that exactly match the saved entry—if it refuses to fill, that's a warning.

Protecting Yourself at the Network and Browser Level

Manual checks are essential, but layered defenses catch what humans miss.

Enable Encrypted DNS

Services like Cloudflare (1.1.1.1) or NextDNS offer free encrypted DNS with built-in malware and phishing blocklists. Configure it at the device or router level and known-bad domains stop resolving entirely.

Use a Privacy-Focused Browser

Brave, Firefox, and even hardened Chrome profiles block trackers, cryptominers, and many known malicious scripts before a page finishes loading.

Keep Software Updated

Most drive-by download attacks exploit outdated browsers or plugins. Turn on automatic updates for your operating system and browser.

Deploy an Ad and Tracker Blocker

Extensions like uBlock Origin block malicious ad networks that occasionally serve as delivery vehicles for exploit kits.

Enable Multi-Factor Authentication

Even if you accidentally hand over a password, MFA (especially hardware keys or app-based codes) usually stops the attacker from getting in.

What to Do If You Already Clicked a Bad Link

Mistakes happen. If you clicked something you shouldn't have, act quickly.

1. Disconnect from the internet to stop any active download or callback to the attacker.
2. Do not enter any information if a login or payment page appeared.
3. Run a full antivirus scan with a reputable tool (Malwarebytes, Windows Defender, or your organization's endpoint tool).
4. Change passwords for any accounts you may have touched, starting with email and banking. Use a different, clean device if possible.
5. Enable MFA everywhere it isn't already active.
6. Monitor bank and credit statements for the next 30-60 days.
7. Report the link to Google Safe Browsing, PhishTank, or your workplace security team so others are protected.

Building a Personal Link-Checking Habit

The best defense is a five-second pause before every click on any link that arrived unexpectedly. Ask yourself:

• Was I expecting this?
• Do I recognize the sender and the domain?
• Does anything about the message feel rushed or emotional?
• Can I verify this a different way?

Combine that pause with the tools and steps above, and you'll block the overwhelming majority of link-based attacks aimed at you. Whether you're checking links for yourself or generating short links to share with others, prioritize services—like the ones compared here—that publish transparent safety practices.

Frequently Asked Questions

Is a link with HTTPS always safe?

No. HTTPS only means the connection between your browser and the server is encrypted. Attackers can easily obtain free SSL certificates for their phishing domains. Always verify the domain itself, not just the padlock icon.

Can I get hacked just by clicking a link without entering anything?

It's possible but uncommon on fully updated devices. Most attacks require you to enter credentials, download a file, or approve a prompt. However, exploit kits targeting unpatched browsers can install malware with no interaction, which is why keeping software current matters.

Are shortened links inherently dangerous?

No. URL shorteners are legitimate tools used by marketers, journalists, and everyday users. The risk comes from not knowing the destination. Use an expander tool or a shortener with built-in link previews and malware scanning to stay safe.

What's the fastest way to check a link on my phone?

Long-press the link to preview the full URL, then copy it and paste it into virustotal.com in your mobile browser. The whole process takes about 20 seconds and works on both iOS and Android.

Should I click links from people I know?

Not automatically. Compromised accounts are one of the top ways malicious links spread. If a message from a friend, colleague, or family member seems out of character—especially if it's just a link with little context—verify through another channel before clicking.