Join the waitlist
Free link and QR checker

Check That Link

Scam texts and fake QR codes are built to make you tap before you think. Paste a link, paste the whole message, or upload a screenshot of a QR code, and see where it really goes before you touch it.

Got a QR code? Paste a screenshot of it here, or

Your message stays on your device. The text you paste and the full link are never sent to OneHaven, and we never open the link. The one thing that leaves your phone is the domain name on its own, sent to the public registry to check how old it is. You can switch that off before you check.

About the domain age check. This sends the domain name by itself, for example example.com, to the public registry. Never the full link, the code at the end of it, or anything else you pasted. It is the strongest single signal there is, so it is on by default.

A message with no link in it still works. Many of the worst scams do not use one.

What this can and cannot tell you

It can tell you what the address itself says.
Which domain actually owns it, whether the name you recognise is really the owner or just a label, whether the characters are what they appear to be, whether the link hides its destination, and how long ago the domain was registered.
It can tell you what the message is doing.
Rushing you, threatening you, asking for a code, asking for secrecy, steering you to a payment that cannot be reversed, or moving you to another app.
It does not know every company in the world.
No tool does. It recognises the big names people are impersonated as, and more usefully it recognises the shapes a fake address takes: a real ending buried in the middle, a name sold underneath somebody else's domain, a familiar word with a shopping word bolted on, a domain registered last week. A counterfeit shop for a smaller brand will usually trip one of those even though the brand itself is not on any list. If it does not, the age check below often still does.
It cannot tell you a link is safe.
It does not open the link, follow redirects, or check anyone's list of known bad sites, because doing that would mean sending your link to a server. A brand new scam page on a perfectly ordinary looking domain can still pass. Nothing stood out is not the same as this is fine.

If you are unsure, the answer is always the same and it always works: do not tap it. Go to the company yourself, through their app, your own bookmark, or the number printed on your card.

How to read a web address

This is the most reliable check there is, and you can do it without any tool at all.

  1. Find the last part before the first single slash. That is the domain.
  2. Read it backwards from the dot. The real owner is the word immediately before the .com, .net or .org. Everything in front of that is just a label, and anyone can put any label there.
  3. Everything after the first slash belongs to whoever owns that domain. It cannot change who they are.
yourbank.example/alerts/verify   belongs to yourbank yourbank.secure-verify.example/alerts   belongs to secure-verify yourbank-support.example   a different domain anyone can buy yourbank.com-alerts.example   the .com is in the middle, so it is not the ending

If you already tapped it

Tapping a link is usually not the moment things go wrong. Entering something is. If you did not type a password, a card number or a code, the realistic risk is low: close the page, and do not go back to it.

If you did enter something, move quickly. Change that password from a different device, starting with your email, then call your bank on the number printed on your card. There is a full walkthrough on the scam library page, including who to report it to.