Is this email a phishing attempt?
A checker that answers “safe” or “dangerous” is worse than nothing, because a good forgery will get a “safe”. This shows you the signals and explains each one, so the judgement stays with the person who can actually make it.
- Runs entirely in your browser
- Works offline
- No upload
- No sign-up
- No watermark
Loading the tool…
How it works
- Get the message source (Show original in Gmail, Ctrl+U in Thunderbird) and paste it. Headers alone are already useful.
- Read the signals. Several together are what matters, not any single one.
- Whatever it says, never use a link or a phone number from the message. Type the address you already know, or call the number on your card.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see fetch the tool’s own code — and, for a few heavy tools, their open-source engine from a public CDN — plus one small page-view ping to loreatec.jp (page address and title, nothing more). None of them carry your file.
Frequently asked questions
Why does it not just tell me if it is phishing?
Because that answer would be wrong often enough to be dangerous. A competent forgery passes authentication on a domain the attacker owns, contains no flagged words, and looks exactly like the real thing; a legitimate invoice from a small supplier can trip half the signals here. The useful output is the reasoning, not a label — and the decisive question is usually not technical at all: were you expecting this?
The authentication passed. Does that mean it is genuine?
It means the message really was sent by the domain in the From line. It does not mean that domain is who you think: anyone can register amaz0n-support.com, set up perfect SPF, DKIM and DMARC, and send you a fully authenticated forgery. Authentication proves the sender, not their honesty.
What are lookalike and punycode domains?
A lookalike is a domain one or two characters away from a real one — rnicrosoft, amaz0n, paypa1. Punycode goes further: xn-- domains let non-Latin letters that look identical to Latin ones appear in the address bar, so a domain can be visually indistinguishable from the real one while being a completely different name.
Is anything sent anywhere when I check a message here?
No. No domain is resolved, no link is opened, no image is loaded. That last one matters: opening a phishing message in a mail client with images enabled already tells the sender that your address is live.
I have already clicked or entered something. What now?
Change the password on the real site immediately, from a device you trust, and change it anywhere you reused it. If it involved card or bank details, call your bank first — they can freeze it. In Japan, report to the police on #9110 and to the Council of Anti-Phishing Japan. Speed matters far more than working out how it happened.