How the safety scanner works
Can I Share This? is designed to help you spot warning signs before opening a suspicious URL. It combines observable URL and destination signals into a simple verdict, while clearly separating that first check from optional third-party reputation lookups.
What Can I Share This? is
Can I Share This? is a free link safety checker that analyzes URLs before you open or share them. The service is designed to explain observable link-safety signals before a user opens, shares, signs in, pays or downloads.
Results are evidence summaries, not certifications. The methodology separates what the scanner observed from what it could not verify.
What the quick scan checks
The first scan examines signals that can be evaluated without trusting the sender or using your signed-in browser session. Depending on the URL and response, the checker can look for:
- direct IP-address links, punycode and visually confusing hostnames;
- shortened URLs and unusually complex subdomain structures;
- brand-lookalike domains and phishing-style wording;
- unexpected ports, insecure HTTP and suspicious login contexts;
- executable, archive or forced-download indicators;
- redirect chains, destination changes and basic response metadata.
A signal is evidence to inspect, not proof by itself. Legitimate sites can use redirects, long URLs or unusual infrastructure.
How the risk score should be read
Signals are combined into a risk score and a plain-language verdict. The score is not a probability that a site is malicious. It is a way to summarize the warning signs observed during this specific check.
A low-risk result means no obvious danger was found in the checks performed. A caution result means characteristics deserve verification. A high-risk result means the observed warning signs are strong enough that you should avoid opening the link and use the official site or app instead.
Why the final destination matters
The text shown in a message is not necessarily where a link ends. Shorteners, tracking systems and malicious redirectors can send a browser through several addresses before reaching the final host.
The result therefore highlights the final destination and, when relevant, shows that the host changed after redirects. A destination change is not automatically malicious, but it is important context when the message claims to come from a bank, delivery company, marketplace or other recognizable service.
Optional reputation checks
The quick scan and the external reputation check are deliberately separate. If you choose Check reputation, the interface asks for consent before a public URL is shared with supported external threat databases.
Private or signed links can contain access credentials inside their query parameters. The deep-check flow is designed to block known sensitive parameters instead of sending those URLs to an external reputation provider.
Privacy by design
Checks are performed without your browser session cookies. Product analytics are limited to interaction events such as opening the homepage, pasting, analyzing and starting a deep scan; the scanned URL itself is not included in those analytics events.
The QR-code scanner also keeps the image decoding in the browser on supported devices rather than uploading the screenshot to the scanning API.
Images, QR codes and AI
Screenshot and photo analysis uses local browser OCR and QR decoding to extract visible text, links and destinations. Extracted evidence is then combined with technical checks; raw image bytes are not required by the Gemini-free safety flow.
On supported browsers, QR decoding is attempted locally first. Image OCR and QR extraction are performed locally in the browser when supported; extracted evidence is then analyzed by the safety pipeline. See the Security & Privacy page for data-handling details.
What the scanner cannot guarantee
No URL checker can certify that a link is safe. A page can change after it was checked, a new phishing site may not yet appear in reputation databases, and previously unknown malware may evade existing defenses.
Can I Share This? is not a replacement for browser security warnings, endpoint protection, password managers, official apps or independent verification of an unexpected request. If a link asks for a password, payment, recovery phrase, identity document or one-time code, verify the destination independently even when the structural result is low risk.
How to use the verdict
Low risk: continue cautiously only if the link was expected. Caution: verify the sender and final domain before signing in, paying or downloading. High risk: do not open the link; reach the service through its official website or app.
Link safety reference library
Technical reference pages explaining the signals used when evaluating suspicious links.
Email safety guides
Focused references for checking suspicious sender addresses and understanding email-domain authentication.
Got something suspicious?
Paste it, upload it or photograph it before you trust it.
Scam prevention guides
Learn how common delivery, bank, account, marketplace and impersonation scams work.