Login Link Checker: Is This Link Safe to Open?
Paste the link you were sent and the checker reads the address for warning signs, then rates it low, medium or high. It cannot see who owns a site, so a low rating is not a green light.
How to use it
- Copy the link without opening it: press and hold it and choose the copy option. The WhatsApp and Telegram guide shows each app.
- Paste only the link into the box above. A whole message makes it answer “Can’t read this”.
- Tap Check this link. Read the badge first, then the list headed Why.
Check the line “The site this link belongs to”. If it is not the name you expected, stop.
What it looks for
Each warning sign adds points. The Why list shows them heaviest first, and the bar under the badge fills in step with the total, out of 100.
| Warning sign | Points |
|---|---|
| A number instead of a name (a bare IP address) | 60 |
| An @ sign that hides the real destination | 60 |
| A famous name (from a list of about thirty) inside someone else’s site | 35 |
| The platform’s name in any address except the one its own help page names | 30 |
| Look-alike letters from another alphabet | 30 |
| A well-known link shortener | 30 |
A direct download of an Android app file (.apk) | 25 |
Plain http, with no secure connection | 20 |
An unusual port number, as in :8443 | 20 |
| Three or more hyphens in the name (two score 8) | 20 |
Three or more sub-names before the site’s own name, as in a.b.c.example.com | 20 |
| A second address inside the link that forwards you | 20 |
A very cheap ending such as .xyz or .top | 15 |
| Words such as login, verify or bonus in the name | 12 |
| Seven or more digits in the name | 12 |
| A link longer than 150 characters | 8 |
How the rating is decided
The points are added up and capped at 100. Under 25 is Low. From 25 to 59 is Medium. From 60 up is High.
So one mild sign stays Low: plain http scores 20, a cheap ending 15. One firm sign, such as a short link, an .apk file or the platform’s name on another site, lands in Medium. A bare IP address or an @ trick is High alone. Mild signs add up: plain http plus a cheap ending makes 35, which is Medium.
Reading three results
At the time of writing (8 October 2026), the example buttons give the results below. The bar shows the total, so the numbers here are the points behind it.
Low: the plain site
https://example.com/, the “plain site” button, scores 0, so there is no Why list. A Low can still carry a reason, though: http://example.com/login also reads Low, at 20 points, but its list says “No secure connection (http)”. Read the list, not only the badge.
Medium: the short link
The “short link” button fills the box with a link on a well-known shortening service. It scores 30 from one sign, “Shortened link”. The checker is not calling the link bad. It is saying the address hides where the link goes, and it cannot look. Short links shows how to find out.
High: the platform’s name on another site
The button labelled “uses the platform’s name” fills the box with a made-up address: the platform’s name, the words bonus and login, hyphens between them and a .top ending. It scores 65 from four signs: the platform’s name on another site (30), the cheap ending (15), the login and bonus words (12) and two hyphens (8). The first sign alone would be Medium; together they pass 60.
The other High buttons work the same way. “Look-alike name” scores 62: a famous payment-app name inside someone else’s site (35), a .xyz ending (15), and login and verify words (12). “Bare IP address” scores 80: a number where a name should be (60) plus plain http (20). Its site line shows the whole number, because an IP address is not a name with an ending.
What a Low result does and does not mean
Low means the address earned fewer than 25 points, and often none. It does not mean:
- The site belongs to who you think. The tool cannot see who owns a site, how old it is or what its page does.
- The link is the platform’s. The tool knows one platform name and the one address that platform’s own help page names. A copy that misspells the name earns no mark for it, and neither does a copy of any other site. Look-alike domains shows the tricks it cannot see.
- Nothing more will happen after you tap. A page can still forward you or start a download.
One address gets a note of its own. Paste the address the platform’s own help page names and the result adds a line saying so, with the date. It is the platform’s statement, quoted, not our verdict. The tool still cannot see who runs any site.
If the result is Medium or High
- Do not open the link, and do not type your number, password or an OTP (a one-time code sent by SMS) on it.
- Ask the sender by another route, such as a phone call. If their chat account was hacked, a reply in the same chat answers nothing.
- Start from an address you already know. At the time of writing, the platform’s own help-centre guide tells members to type its navigation address themselves rather than follow links from strangers. Finding the right link goes through it.
- If you already tapped and typed something, follow what to do after a scam.
Privacy
The checker is code in this page. It reads the text you paste and nothing else, so nothing is uploaded or looked up, which is also why it cannot see who owns a site. The other free tools work the same way, and the privacy page covers the rest.
Go deeper
- WhatsApp and Telegram links: copying a link without opening it.
- APK download links: five kinds of file link.
- Short links: previewing a destination without visiting it.
- Look-alike domains: spelling tricks, and reading an address right to left.
More about the login link checker
Common questions
Does a Low risk result mean the link is safe to open?
No. Low means the address earned fewer than 25 points of warning signs, and often none. The checker cannot see who runs the site, how old it is or what the page does, so a copy of a login page with a clean-looking address can still score Low. Treat Low as “nothing obvious”, then think about where the link came from.
Can the checker tell me whether a link belongs to the platform?
Only in part. It knows the platform’s name and marks any address that uses the name but is not the address the platform’s own help page gives. It cannot see who runs any site, and a misspelt copy of the name gets past that rule. For every other name it cannot tell a copy from the real thing.
Why did a link I know is fine come up Medium?
Each warning sign is a reason to look closer, not proof of a scam. Some honest links use a shortener, end in .apk or contain a word like login. The famous-name check also matches letters, so an honest name that merely contains one, such as pineapple-stall.example with “apple” inside it, is marked.
Does the link checker keep the links I paste?
No. The checker is code that runs in your browser. It reads the text you paste and sends it nowhere, so nothing is stored or looked up. That is also why it cannot check who owns a site.
What does “Can’t read this” mean in the checker?
The box did not hold a normal web address. Usual causes are a whole message pasted instead of only the link, a link that starts with an app’s own prefix such as tg:// rather than https://, or a typing slip. Copy the link on its own and try again.