Common Questions

Yes, RevealURL is completely free to use. We believe in a safer internet for everyone, and this tool is our contribution to that goal. There are no hidden fees or premium subscriptions.

No. URLs you check are never written to disk or stored in a database. Your IP address is held in server memory for up to 60 seconds solely to enforce rate-limiting, then discarded. We do not log which URL was checked by which user.

We support virtually all URL shortening services, including bit.ly, tinyurl.com, t.co (X / Twitter), ow.ly, rb.gy, and many others. If a URL redirects, we can follow the chain and reveal its final destination.

The safety score runs from 0 to 100, where 100 means perfectly safe and 0 means maximally dangerous. A score of 61 or above is shown as Safe, 21 to 60 as Suspicious, and 20 or below as Dangerous. The score is built by accumulating risk points across more than a dozen independent checks and then subtracting that total from 100. Confirmed hits from threat databases like Google Safe Browsing or URLhaus immediately drop the score to 0. Softer signals such as a newly registered domain, an unusual file extension, or missing security headers each reduce the score by smaller amounts. The individual factors that triggered the result are listed beneath the score so you can judge for yourself.

False positives can happen. Our scoring system is intentionally cautious because the cost of missing a genuine threat is higher than the cost of a false alarm. Common reasons a legitimate link might score higher than expected include: the domain was registered recently, the site uses HTTP rather than HTTPS, the hosting provider has a poor reputation on AbuseIPDB due to other tenants on the same server, or the domain name closely resembles a well-known brand. The risk factors shown beneath the score will tell you exactly which signals triggered it, so you can decide whether those factors apply to your specific situation.

The destination site will see a request from our server, not from your browser or your IP address. We also suppress the Referer header, so the site cannot tell that the request originated from RevealURL. From the destination's perspective it looks like an anonymous visit from an unknown server, with no connection to you personally.

Yes. The Bulk Checker tool accepts up to 10 URLs at once, one per line, and runs the full safety scan on each in parallel. This is useful when reviewing a batch of links from a document, message, or spreadsheet. There is also an Email Scanner tool that automatically extracts all links from pasted email body text and checks them all in one go, which is the quickest way to review a suspicious email before acting on any of its links.

Yes. On the home page there is a Scan QR Code tab next to the URL input. You can drag and drop an image of a QR code onto the upload zone, or click it to browse for a file. The QR code is decoded entirely in your browser using local processing, so the image itself is never sent to our servers. Once decoded, the URL it contains is automatically placed into the input field ready to be checked.

Each IP address can make up to 10 requests per minute. For most everyday use, including the bulk and email scanner tools, this limit will never be noticeable. It exists to protect the service from automated abuse and to keep it fast and reliable for everyone. The limit resets automatically after 60 seconds and does not require any action on your part.

A full scan involves following the redirect chain to the final destination, querying six threat databases, fetching the page for content analysis, checking the SSL certificate, running DNS analysis, looking up the domain registration date, and querying the Internet Archive. All of these checks run simultaneously rather than one after another, which keeps scan times low. Most scans complete in two to four seconds. Occasional slowness is usually caused by a slow response from a third-party threat database or a destination server that takes time to respond.

When you click a link your browser may be silently forwarded through several intermediate addresses before landing on the final page. Attackers use long redirect chains to obscure the true destination, bypass spam filters that only check the first URL, and route victims through tracking or affiliate systems before delivering the malicious payload. RevealURL follows every hop in the chain and shows you the full journey so you can see exactly where a link is taking you and whether any step along the way looks suspicious.

Yes, it can. No automated scanning tool catches every threat. A brand new phishing site that has not yet been reported to any of the threat databases will score low even if it is genuinely dangerous. Attackers also use techniques to serve different content to bots and scanners than they show to real visitors. RevealURL is a useful first line of defence and significantly reduces your risk, but it is not a guarantee. If something feels wrong about a link regardless of what the scan says, trust your instincts and do not click it.