Every tool runs entirely in your browser. Your data is never sent to any server — not ours, not anyone's.
Paste any suspicious URL to check for domain spoofing, suspicious TLDs, token leaks, punycode tricks, and 10 more phishing signals.
Check a linkTest any password for entropy, common patterns, dictionary words, keyboard walks, and estimated crack time. Real-time analysis as you type.
Test a passwordUpload a QR code image or use your camera to decode it. If it contains a URL, we automatically check it for phishing signals.
Scan a QR codePaste a suspicious email to scan for urgency language, threat tactics, spoofed links, credential requests, and social engineering patterns.
Check an emailPaste raw email headers to trace the real sender, view relay hops, and check SPF, DKIM, and DMARC authentication results.
Analyze headersPaste a JSON Web Token to decode its header, payload, and signature. Flags expired tokens, weak algorithms, and sensitive data in claims.
Decode a JWT NewPaste a page URL and HTML to test the same extension signal that catches fake pages borrowing trust from real brand assets, privacy links, and support pages.
Test backlink signalsPhishClean monitors every page you visit in real time — catching phishing pages, token leaks, and credential theft before they happen.
Install PhishClean Free