1. Paste a link or email
Copy a URL or the body of a suspicious message and paste it into Cactus.
Online safety help
A safer way to check suspicious links and emails.
Beyond links and emails, Cactus checks texts, websites, passwords and more — with simple how-to guides and a weekly scam alert to help you stay ahead.
Checking an email's content instead? Check an email New here? Start here → 🌵 The Daily Scam
Free
Bilingual (EN/FR)
No signup
Privacy-first
Never asks for payment
Choose a check
Did you get something suspicious?
Link check
Is this link safe? Paste it and see.
Phishing email check
Check a suspicious email for phishing.
Scam text check
Spot the scam signs in a text message.
QR code check
See where a QR code really leads.
Batch check
Scan up to 20 links at once.
File hash / malware check
Check a file hash for known malware.
Is a website or domain set up safely?
SSL/TLS check
Grade a site's HTTPS from A+ to F.
Email auth (SPF/DKIM/DMARC)
Can scammers spoof a domain's email?
SPF & DMARC record builder
Build the DNS records that stop spoofing.
Security headers
Grade a website's security headers.
Look-alike (typosquat) domains
Find look-alikes impersonating a domain.
Certificate logs & subdomains
Discover a domain's hidden subdomains.
WHOIS / domain age
Who owns a domain, and how old is it?
DNS lookup
A domain's DNS records at a glance.
IP reputation
Is an IP on spam or abuse blocklists?
Subnet calculator
Network, broadcast, and host range from a CIDR.
What is my IP?
See your public IP and what it reveals about you.
Protect your accounts & privacy
Practice & stay current
Scam of the week
Marketplace scamThe fake concert-ticket resale scam
A sold-out show, a stranger selling tickets at face value, and a request to e-Transfer first. The tickets never arrive - or were sold to a dozen people - and an accepted e-Transfer is almost impossible to get back.
2. Get a score
Cactus looks for common warning signs — lookalike domains, urgency wording, known unsafe matches — and gives a confidence percentage.
3. Learn what to do
You get plain-language reasons and a recommended next step before you click.
Frequently asked questions
Is Cactus Security free to use?
Yes. Every tool on Cactus is free and bilingual, with no account or sign-up required. If you find it useful, you can support the project with a small donation.
How do I check if a link is safe?
Paste the URL into the link checker. Cactus inspects it for phishing signs, lookalike domains, suspicious redirects, the domain's age, and matches against threat-intelligence sources, then gives a clear safety score.
What should I do with a suspicious email?
Don't click any links or download attachments. Paste the email into the email checker, which analyzes its links, urgency wording, and sender headers, and explains the risks in plain language.
What is phishing?
Phishing is a scam where attackers impersonate a trusted person or company to trick you into clicking a malicious link, entering a password, or sharing personal information. Cactus helps you spot these attempts before you act.
Does Cactus store the links or emails I check?
Cactus processes each check on the server to produce your result and doesn't require an account. See the Privacy page for exactly what each tool sends to third parties and what is kept.
Run into a term you don't know? Browse the plain-language security glossary