Is this link a phish?

Paste a suspicious link. PhishLens reads the address itself — its structure, its domain, the words it uses — and tells you the risk and why, in plain language. The link is never opened or visited.

No account. Nothing is stored. The URL is analysed on this server and discarded.

Try one: or

How it works

Feature extraction
45 features are measured from the URL string alone: lengths, dots and subdomains, special characters, whether the host is an IP number, punycode, link shorteners, sensitive words, brand names in the wrong place, and the randomness of the domain name.
Two detectors, side by side
A transparent rule-based detector scores weighted warning signs, and a Random Forest trained on verified PhishTank URLs and Tranco domains gives a phishing probability. The headline score is the average of the two.
Explanations, not just a score
Every triggered rule is listed with its weight, and SHAP attributions from the model are translated into plain sentences — so you learn the warning signs, not just the verdict.

See the model & metrics page for the real holdout results, the datasets, and the honest limitations.

One paste, every check

A single check runs all of these — including the tricks most people have never heard of:

The “@” trick — everything before @ is ignored; the address you see is a decoy.
Typosquat — a domain one or two letters from a real brand (paypaI, gooogle).
Open-redirect laundering — the link starts on a trusted site but redirects elsewhere.
File-extension domains — invoice.zip looks like a file, but it is a website.
Invisible characters — hidden letters that change what the address really is.
Free-hosting logins — a fake login page on a platform anyone can publish on.
Homoglyphs — look-alike letters from another alphabet impersonating a brand.

HTTPS does not mean safe. Most phishing sites now use HTTPS — a padlock means the connection is encrypted, not that the site is honest. PhishLens treats HTTPS as a weak signal only.