About
A fully open-source phishing detection engine that runs multiple checks in real time and explains exactly what it found. No accounts, no hidden algorithms. Built for people who want to understand why a link is safe, not just be told it is.
Why this exists
Phishing links show up in emails, DMs, QR codes, and shortened URLs. Most people either click and hope, or avoid the link entirely. Neither is good. Existing tools don't close that gap: quick scanners return a pass/fail with no explanation, thorough crawlers take too long and bury results in raw technical data. Nothing is both fast and legible.
url.vet (also known as URLvet, previously SafeSurf) is that middle ground. Paste a link, get a trust score, a verdict, and a full breakdown in seconds. No guesswork, no signup, nothing hidden.
It runs 18 checks: URL structure, DNS, TLS, domain age, typosquatting, page content, and live threat feeds. Each produces a plain-language reason, so you always know what moved the score.
Philosophy
Explainability over security theater
A verdict you can't explain is a verdict you can't trust. Every signal is shown, whether it helped or hurt the score.
Live over cached
Phishing pages spin up and disappear in hours. Scanning at request time catches what static databases miss.
Open source by default
Security tools should be auditable. The entire detection engine is on GitHub under AGPL-3.0.
No friction
No account, no ads, no API key. Paste a URL, get an answer.
Team
Creator & maintainer
Got one too many suspicious links with no good way to check them, so built url.vet.
With help from friends on GitHub.
Open source
url.vet is fully open source. A lot of projects call themselves open source but only publish the frontend while keeping the actual engine private. Here, everything is publicly available. The detection engine, scoring logic, API, and frontend. Nothing hidden.
The community edition is licensed under AGPL-3.0. Free to use, self-host, and modify. Found a bug or want to contribute? Pull requests are welcome.
Get in touch
Feedback, false positives, or just to say hi. Reach out at [email protected].