Runs in your browser — nothing is sent anywhere
Link safety checker
Paste a URL and see what is structurally suspicious about it. Same checks Keyway runs on every destination, running locally on your own device.
What this checks, and what it cannot
It looks for the structural warning signs — the ones visible in the URL itself:
- Dangerous schemes —
javascript:,data:,file:and friends. - Embedded credentials —
https://evil.example@bank.example/sends the browser to bank.example while you read evil.example. - Homograph spoofing — a domain mixing Latin with Cyrillic or Greek, decoded from punycode. This is how
аpple.comis spelled with a Cyrillic а. - Private and internal addresses — loopback, RFC 1918, link-local, cloud metadata, including decimal, octal and IPv6-wrapped disguises.
- Non-standard ports, which on a link someone sent you is a probe more often than a website.
- Risk signals — URL shorteners, high-abuse TLDs, free subdomain hosts, IP-literal hosts, and credential vocabulary in the path.
What it cannot tell you
Whether the page at the other end is malicious. A perfectly formed URL on a clean domain registered forty minutes ago passes every check here, because structural analysis cannot see content. Treat a clean result as "nothing obviously wrong with the address", never as "safe to open".
For a live reputation verdict, use Google Safe Browsing or VirusTotal — both of which do send the URL somewhere, which is the trade.
Reading the result
Rejected means the URL breaks a hard rule. Keyway refuses these outright as destinations, and you should treat one someone sent you the same way.
Flagged means something raised the risk score without being conclusive. A shortener is the common case — heavily abused, and also how a lot of honest people share files. Flags are a reason to look closer, not a verdict.
Clean means nothing structural is wrong. See above for why that is a much weaker statement than it sounds.
More on how these checks are used in production:the safety page.