Features

Everything you need to stay safe online

Six powerful scan types, all powered by real-time DNS and SSL certificate verification. No subscriptions, no premium tiers.

Link Scanner

Paste any URL to check it against live DNS records, SSL certificates, phishing databases, suspicious TLDs, URL shorteners, and brand impersonation patterns.

Live DNS + SSL

Message Scanner

Paste SMS texts, WhatsApp messages, or emails. Detects scam patterns, urgency language, embedded phishing links, and fake sender addresses.

Smart Detection

QR Code Scanner

Use your camera to scan any QR code. The app decodes and safety-checks the destination URL in real time before you visit it.

Camera

File Scanner

Analyse any file's metadata, extension, and SHA-256 hash. Deep scan checks magic bytes, detects hidden macros, and identifies steganography.

Deep Scan

Email Header Analyser

Paste raw email headers to verify SPF, DKIM, and DMARC authentication. Detects sender spoofing, forged results, and suspicious routing.

Auth Check

Domain Scanner

Analyse any domain's full DNS infrastructure, SSL certificate status, mail configuration, and security posture with a comprehensive live assessment.

Full Profile
Technology

Real-time DNS & SSL verification

Every scan queries live DNS servers and verifies SSL certificates. No stale blocklists. Catches brand-new scam domains within minutes of creation.

Domain existence

Verifies the domain actually resolves with A and AAAA records. Non-existent domains are immediately flagged.

Mail server records (MX)

Checks if the domain has mail servers configured, catching fake email sender domains.

SPF, DKIM, and DMARC

Validates email authentication records and cross-references them against header claims.

SSL/TLS certificate checks

Verifies certificate validity, expiry dates, issuer, and self-signed status. Flags expired or missing certificates.

NS, CAA, CNAME, and TXT

Full infrastructure profile: nameservers, certificate authorities, aliases, and custom records.

// Real-time DNS verification
SCAN suspicious-bank-login.xyz

A RECORD → No records found
MX RECORD → No mail servers
SPF → Missing
DMARC → Missing
NS → Unresolvable
SSL → No certificate

// Heuristic analysis
TLD → .xyz (suspicious)
BRAND → Impersonates "bank"
PATTERN → "login" in subdomain

VERDICT: DANGEROUS (confidence: 92%)
Recommendation: Do not visit this link.
How It Works

Three steps to stay safe

No sign-up required. Just open, scan, and get your verdict in seconds.

1

Choose your scan

Open the app and pick a scan type: Link, Message, QR Code, File, or Email Headers.

2

Paste or scan

Paste a suspicious link or text, point your camera at a QR code, or select a file.

3

Get your verdict

Receive a clear Safe, Caution, or Dangerous verdict with detailed explanations and next steps.

Trust & Privacy

Built with privacy at the core

Your safety data stays on your device. We never collect, share, or sell personal information.

No data collection

Scan history lives on your phone, not our servers.

UK GDPR compliant

Fully compliant with UK GDPR and the Data Protection Act 2018.

No ads or tracking

Zero advertising. Zero analytics cookies. Zero tracking pixels.

Family friendly

Designed for ages 13+. Family Mode adds extra safety warnings.

FAQ

Frequently asked questions

Quick answers about how Is This Safe? works, what it checks, and your privacy.

The app performs real-time live DNS lookups and SSL certificate verification on every URL. It checks A, AAAA, MX, SPF, DMARC, NS, CAA, CNAME, and TXT records in parallel, plus verifies the site's SSL certificate for validity, expiry, and issuer. It detects brand impersonation, typosquatting, suspicious TLDs, URL shorteners, and known phishing patterns. Unlike blocklist checkers, this catches brand-new scam domains within minutes.

Yes. The email header analyser performs live DNS lookups to verify SPF, DKIM, and DMARC authentication records. It cross-references header claims against actual DNS records, detecting forged authentication. It also checks for sender spoofing, Reply-To mismatches, brand impersonation, and suspicious routing patterns.

Yes, 100% free. No ads, no subscriptions, no in-app purchases, and no premium tiers. All five scan types are available at no cost. The app is and will remain free.

No. Scan history is stored locally on your device, not on our servers. We only receive the URL, text, or file metadata needed for the safety check. No personal information, contacts, or file contents are transmitted. Fully compliant with UK GDPR.

It means the app queries live DNS servers and performs SSL/TLS certificate checks in real time for every scan. Instead of relying on static blocklists, it verifies domain existence, mail server records (MX), email authentication (SPF/DKIM/DMARC), nameserver configuration, and SSL certificate validity. Expired, self-signed, or missing certificates are flagged immediately. This catches brand-new scam domains before they appear on any blocklist.

Point your phone camera at any QR code. The app decodes it and runs a full safety scan on the decoded URL or text, including DNS verification, phishing detection, and brand impersonation checks. All before you visit the link.

The quarantine system isolates links, messages, files, and QR codes flagged as dangerous. Items are held in a secure review area where you can examine threat details and decide to restore or permanently purge each one.

Is This Safe? is designed for users aged 13 and up. Family Mode provides stricter safety warnings suitable for teenagers. The interface uses clear, friendly language and visual indicators that all ages can understand.

Yes. Fully compliant with UK GDPR and the Data Protection Act 2018. Built with privacy by design and by default. No personal data collected, no tracking cookies. Your data rights are accessible via Settings. See our privacy policy for full details.

Start scanning in seconds

Download the free app from Google Play or use the web version — no account needed.

Download on Google Play Use Web Version

Free on Android · Web version works in any browser · No sign-up required