Every tool runs entirely in your browser. Your data is never sent to any server — not ours, not anyone's.
Paste any suspicious URL to check for domain spoofing, suspicious TLDs, token leaks, punycode tricks, and 10 more phishing signals.
Check a linkTest any password for entropy, common patterns, dictionary words, keyboard walks, and estimated crack time. Real-time analysis as you type.
Test a passwordUpload a QR code image or use your camera to decode it. If it contains a URL, we automatically check it for phishing signals.
Scan a QR codePaste a suspicious email to scan for urgency language, threat tactics, spoofed links, credential requests, and social engineering patterns.
Check an emailPaste raw email headers to trace the real sender, view relay hops, and check SPF, DKIM, and DMARC authentication results.
Analyze headersPaste a JSON Web Token to decode its header, payload, and signature. Flags expired tokens, weak algorithms, and sensitive data in claims.
Decode a JWT NewPaste a page URL and HTML to test the same extension signal that catches fake pages borrowing trust from real brand assets, privacy links, and support pages.
Test backlink signalsEvery tool on this page is plain JavaScript executing on your own machine. Nothing you paste — a URL, a password, an email header, a token — is uploaded, logged or stored anywhere. You can confirm it yourself: open your browser's Network tab and run any tool on this page, and you will see that no request leaves it.
That design has a practical payoff beyond privacy. Because there is no server in the loop, these tools work on internal URLs, staging environments and intranet pages that a hosted scanner could never reach. There are no rate limits, no queue, and no account to create.
The trade-off is that they only inspect what you hand them. They cannot see the page you are actually on — which is exactly what the extension is for: the same class of checks, running automatically against every page you visit.
PhishClean monitors every page you visit in real time — catching phishing pages, token leaks, and credential theft before they happen.
Install PhishClean FreeLast updated: