The Trust & Safety Toolkit
14 free tools for taking apart whatever landed in your inbox, your messages or your invoice pile. All but one of them never make a network request at all: the work happens on your own machine, so you can paste a bank detail or a password without handing it to anybody.
Message & sender forensics
Work out who actually sent something, and whether the name on it is real.
Email header analyzer
Trace an email back to the machine that really sent it, and read its SPF, DKIM and DMARC results.
runs offlineDisposable email checker
Tell a real mailbox from a ten-minute burner, a role account or a plus-address alias.
runs offlineHomoglyph inspector
Expose the Cyrillic a, the zero-width space and the Punycode behind a lookalike domain.
runs offlineLinks, codes & payloads
Unwrap anything that hides where it really goes before you open it.
QR code scanner
Read the destination hidden in a QR code image without ever opening it.
runs offlineURL inspector
Split a link into its real destination, its tracking junk, and the redirect buried in the query string.
runs offlineDecoder ring
Auto-detects Base64, hex, percent-encoding, entities and JWTs, then peels nested layers until it hits plain text.
runs offlineAccount & payment numbers
Every one of these numbers carries a checksum. A typo fails it, and so does an invention.
IBAN validator
Verify the mod-97 checksum, country and length of an international account number before a transfer.
runs offlineCard number checker
Run the Luhn checksum and read the network and card type out of the leading digits.
runs offlineRouting number checker
Validate the nine-digit ABA checksum and read the Federal Reserve district it belongs to.
runs offlineCrypto address validator
Verify a BTC, ETH, LTC, DOGE, BCH, TRX or XRP address against its own checksum before you send.
runs offlinePasswords & personal security
Test what you already use, then generate something that survives a real attack.
Files & images
See what a file proves about itself, and what it quietly leaks about you.
Where these stop, and the full check starts
Everything on this page answers a question about form. Does this number satisfy its own checksum? What is really inside this QR code? Which server actually handed over this email? Those are questions with exact answers, which is why they can be settled in your browser in a millisecond and without asking anyone.
They cannot answer the question you probably arrived with, which is whether the thing is honest. A criminal's IBAN passes mod-97. A phishing page has a valid certificate. For that you need registration history, blocklist membership, hosting reputation and impersonation checks — so paste the link, number or message into the main check and you will get a record with the evidence behind every point of the verdict.