Free security tools
All of Cactus's security tools
Every Cactus checker in one place, grouped by what you're trying to do. All free, no signup, and bilingual - pick a tool to get a clear, plain-language result.
Something suspicious
Is this link safe?
Paste a link and see where it really goes, before you click.
Is this text a scam?
Paste a text, WhatsApp or Messenger message and we point out the scam signs.
Is this email really from them?
Paste the email. We check every link and look for the usual phishing tricks.
Where does this QR code go?
Upload a photo of the code and we read the link hidden inside it.
Are they rushing you to pay?
Gift card, e-transfer or crypto - see which payments can't be undone.
Is this file known malware?
Paste a file's hash (its fingerprint) to see how many antivirus engines flag it.
Got a whole list of links?
Paste up to 20 links, one per line, and get one table with all the results.
A website you don't trust
Is this site's padlock real?
Check the site's certificate and encryption, and get a grade from A+ to F.
How old is this website?
A site registered last week is a red flag. See its age, owner and registrar (WHOIS).
Is this a copy of a real brand?
Enter a real domain to see the look-alike (typosquat) versions scammers register.
Your accounts and privacy
Has my password leaked?
Check it against billions of leaked passwords. It never leaves your browser.
Was my email in a leak?
See which companies leaked your address, so you know where to change your password.
Need a stronger password?
Get a random password, or a passphrase you can actually remember.
Does my photo show where I live?
Photos carry hidden GPS and camera data (EXIF). Strip it without uploading anything.
What is my IP?
See your public IP and what it reveals about you.
Your own site or domain
These are for people who run a website, a domain, or company email.
Can someone send email as you?
Check whether SPF, DKIM and DMARC are set up to stop spoofing, and get a grade.
Stop others sending as you
Answer two questions and copy the exact SPF and DMARC DNS records into your zone.
Does your site protect visitors?
Grade the HTTP security headers your site sends - HSTS, CSP and the rest.
Which subdomains are exposed?
Every certificate ever issued for a domain is public. See what those CT logs reveal.
Why won't my certificate issue?
Certbot timing out, a CAA error, DNS not propagated? We run Let's Encrypt's own (ACME) checks and explain the failure.
Where does this domain point?
See a domain's A, MX, NS, TXT and CAA records in one place.
Is this IP address a problem?
See who owns an IP and whether it's on public spam or abuse blocklists.
What's in this IP range?
Enter an address with its prefix (CIDR) for the network, broadcast and host range.