1. Paste a link or email
Copy a URL or the body of a suspicious message and paste it into Cactus.
Online safety help
A safer way to check suspicious links and emails.
Beyond links and emails, Cactus checks texts, websites, passwords and more — with simple how-to guides and a weekly scam alert to help you stay ahead.
Checking an email's content instead? Check an email New here? Start here → 🌵 The Daily Scam
Free
Bilingual (EN/FR)
No signup
Privacy-first
Never asks for payment
Choose a check
Something suspicious
Is this link safe?
Paste a link and see where it really goes, before you click.
Is this text a scam?
Paste a text, WhatsApp or Messenger message and we point out the scam signs.
Is this email really from them?
Paste the email. We check every link and look for the usual phishing tricks.
Where does this QR code go?
Upload a photo of the code and we read the link hidden inside it.
Are they rushing you to pay?
Gift card, e-transfer or crypto - see which payments can't be undone.
Is this file known malware?
Paste a file's hash (its fingerprint) to see how many antivirus engines flag it.
Got a whole list of links?
Paste up to 20 links, one per line, and get one table with all the results.
A website you don't trust
Is this site's padlock real?
Check the site's certificate and encryption, and get a grade from A+ to F.
How old is this website?
A site registered last week is a red flag. See its age, owner and registrar (WHOIS).
Is this a copy of a real brand?
Enter a real domain to see the look-alike (typosquat) versions scammers register.
Your accounts and privacy
Has my password leaked?
Check it against billions of leaked passwords. It never leaves your browser.
Was my email in a leak?
See which companies leaked your address, so you know where to change your password.
Need a stronger password?
Get a random password, or a passphrase you can actually remember.
Does my photo show where I live?
Photos carry hidden GPS and camera data (EXIF). Strip it without uploading anything.
What is my IP?
See your public IP and what it reveals about you.
Your own site or domain
These are for people who run a website, a domain, or company email.
Can someone send email as you?
Check whether SPF, DKIM and DMARC are set up to stop spoofing, and get a grade.
Stop others sending as you
Answer two questions and copy the exact SPF and DMARC DNS records into your zone.
Does your site protect visitors?
Grade the HTTP security headers your site sends - HSTS, CSP and the rest.
Which subdomains are exposed?
Every certificate ever issued for a domain is public. See what those CT logs reveal.
Why won't my certificate issue?
Certbot timing out, a CAA error, DNS not propagated? We run Let's Encrypt's own (ACME) checks and explain the failure.
Where does this domain point?
See a domain's A, MX, NS, TXT and CAA records in one place.
Is this IP address a problem?
See who owns an IP and whether it's on public spam or abuse blocklists.
What's in this IP range?
Enter an address with its prefix (CIDR) for the network, broadcast and host range.
Practice & stay current
Scam of the week
Marketplace scamThe fake concert-ticket resale scam
A sold-out show, a stranger selling tickets at face value, and a request to e-Transfer first. The tickets never arrive - or were sold to a dozen people - and an accepted e-Transfer is almost impossible to get back.
2. Get a score
Cactus looks for common warning signs — lookalike domains, urgency wording, known unsafe matches — and gives a confidence percentage.
3. Learn what to do
You get plain-language reasons and a recommended next step before you click.
Frequently asked questions
Is Cactus Security free to use?
Yes. Every tool on Cactus is free and bilingual, with no account or sign-up required. If you find it useful, you can support the project with a small donation.
How do I check if a link is safe?
Paste the URL into the link checker. Cactus inspects it for phishing signs, lookalike domains, suspicious redirects, the domain's age, and matches against threat-intelligence sources, then gives a clear safety score.
What should I do with a suspicious email?
Don't click any links or download attachments. Paste the email into the email checker, which analyzes its links, urgency wording, and sender headers, and explains the risks in plain language.
What is phishing?
Phishing is a scam where attackers impersonate a trusted person or company to trick you into clicking a malicious link, entering a password, or sharing personal information. Cactus helps you spot these attempts before you act.
Does Cactus store the links or emails I check?
Cactus processes each check on the server to produce your result and doesn't require an account. See the Privacy page for exactly what each tool sends to third parties and what is kept.
Run into a term you don't know? Browse the plain-language security glossary