Fast pre-check against Google's threat lists — usually instant, no proxy needed. Bring your own free API key from Google Cloud Console (enable the "Safe Browsing API" for your project).

Your full link is never sent to Google — the link is hashed on your device first, and only a short 4-byte hash prefix leaves the browser to check for a match.

Scanned links are checked against urlscan.io. Bring your own free API key — it's stored only in this browser, never sent anywhere but urlscan.io (or your proxy below).

Note: urlscan.io doesn't send CORS headers on its real API responses, so direct in-browser checks are blocked. Add a proxy URL below to fix this — see the included Worker setup guide.

Without a proxy, urlscan.io checks will usually fail with a network error due to the CORS gap above. A free Cloudflare Worker fixes this — deploy instructions are in the app's README.

All scan history lives in this browser's local storage. Nothing leaves this device except link checks you explicitly run.