Every tool runs entirely in your browser. Your data is never sent to any server — not ours, not anyone's.
Paste any suspicious URL to check for domain spoofing, suspicious TLDs, token leaks, punycode tricks, and 10 more phishing signals.
Check a linkTest any password for entropy, common patterns, dictionary words, keyboard walks, and estimated crack time. Real-time analysis as you type.
Test a passwordUpload a QR code image or use your camera to decode it. If it contains a URL, we automatically check it for phishing signals.
Scan a QR codePaste a suspicious email to scan for urgency language, threat tactics, spoofed links, credential requests, and social engineering patterns.
Check an emailPaste raw email headers to trace the real sender, view relay hops, and check SPF, DKIM, and DMARC authentication results.
Analyze headersPaste a JSON Web Token to decode its header, payload, and signature. Flags expired tokens, weak algorithms, and sensitive data in claims.
Decode a JWTPhishClean monitors every page you visit in real time — catching phishing pages, token leaks, and credential theft before they happen.
Install PhishClean Free