URL Encode and Decode
Encode and decode URLs and parameters (%20, %C3%A7), and inspect each part of a URL.
The rule that covers most cases
Don't use links in messages to access banks, stores, or services that require a password. Open the official app or type the address yourself. That way, even if the message is fake, you won't land on a fake website.
Still, knowing how to read a website address can help you spot scams and decide whether an unfamiliar link is worth opening.
How to read a URL: check the domain
The most important part of a URL is the domain: the part right before the first slash / after https://. Read it from right to left:
https://www.gov.uk/: the domain is gov.uk. Legitimate.https://gov.uk.account-update.com/tax: the domain is account-update.com. "gov.uk" at the beginning is just decoration. Fake.https://www.example.com.account-update.net: the domain is account-update.net. Fake.
Anything after the slash (paths and parameters) can contain any words and doesn’t tell you anything about the site’s safety.
Common tricks used in fake links
- Lookalike characters: "rn" instead of "m," "0" instead of "o," doubled letters, or extra hyphens.
- Different endings: .net instead of .com, or unusual endings.
- Shortened links: Short links hide their destination. Be wary when they come from unknown senders.
- Encoded addresses: Sequences like
%2Fand%40can hide the real destination. The URL encoder and decoder decodes the address and shows each part (domain, path, and parameters) separately, so you can read it clearly. - Padlock (https): It only means the connection is encrypted. Fake sites can have a padlock too. It doesn’t prove a site is legitimate.
Warning signs in the message
- Urgency and threats: "Your account will be locked today," "last chance."
- Unexpected prizes, refunds, or discounts.
- Requests for your password, SMS code, card details, or a selfie.
- Suspicious sender: an unknown number or an email address with a domain that doesn’t match the company’s.
- A generic greeting ("Dear customer") or a message with your name and personal details, which may have come from a data breach.
QR Codes are links in disguise. To see the address in a QR Code image before opening it, use Read QR Code from Image. Learn more in Fake QR Codes: How to Check.
Tools for checking a link
- Preview: On a computer, hover over the link without clicking to see the address in the corner of the screen. On a phone, tap and hold the link to see the address without opening it.
- Google Safe Browsing: Google’s Transparency Report lets you check whether an address has been flagged as dangerous.
- Updated browser: Chrome, Edge, Firefox, and Safari show warnings on pages known for scams. Don’t ignore them.
No check is perfect: new fake sites may not be on the lists yet. That’s why the best rule is still to access important services through their app or by typing the address yourself.
I already clicked. What now?
- You only opened the page and didn’t enter anything: close it. The risk is low when your browser is up to date.
- You entered a password: Change it immediately using the official website or app, and turn on two-step verification. If you used that password elsewhere, change it there too.
- You entered card details: Call your bank and cancel the card.
- You installed an app or file: Uninstall it, run your device’s security scan, and change your passwords from another device.
- You made a payment: Contact your bank immediately and report the incident to the appropriate authorities.
Frequently asked questions
Is a link with https always safe?
No. HTTPS protects the connection from eavesdropping, but any site, including a fake one, can use it. The domain is what identifies the site.
Are shortened links always scams?
No. Companies and individuals use link shorteners legitimately. The problem is when links come from unknown senders and lead to pages that ask for your information.
Do banks send links by text?
Some banks send informational text messages, but the general advice is never to use message links to access your account. Use the app instead.
How do I report a fake website?
You can report it through your browser (most have an option to report a deceptive site) and notify the impersonated company through its official channels.
Is opening a link on a phone safer than on a computer?
The risk is similar. On a phone, the address bar is smaller and hides part of the domain; tap it to see the full address.
A friend sent me the link. Can I trust it?
A friend’s account may have been hacked, or they may have forwarded the link without checking it. If the message seems out of character or asks for personal information, confirm with them through another channel before opening it.