Private human-risk analysis

Phishing Message Analyzer

Understand who a message claims to be from, what it wants, how it applies pressure, and how to verify it safely—without uploading the message.

Tool guidance

How to use this tool

Message text, sender fields, and evidence stay in your browser. Only an explicitly selected URL is sent to the existing scanner.

Choose the message channel and paste the text.

Add identity context if you know it.

Review separate identity, domain, pressure, and requested-action dimensions.

Scan only a URL you explicitly select.

No text-only result is an absolute safety verdict.

Technical mismatches matter more than emotional wording.

Compound cues matter more than one keyword.

Verify from an independently opened official service.

Use Email Identity Checker when raw headers are available.

Use Phishing First Aid if you already interacted.

Submitted content · untrusted message context

ChannelSender, optionalReply-To, optionalClaimed company or serviceExpected official domainCorrect detected action, optional

This claims to be an internal work messageSuspicious message

Message text stays in this browser tab. It is not sent to the server, placed in the URL, stored, or included in analytics.

Safe fictional examples

Research-informed, not a guarantee

Manipulation cues are evidence, not proof. One urgent, authoritative, emotional, or personalized phrase cannot establish phishing.

Technically experienced users can still be deceived. Self-reported knowledge is not treated as proof of resilience.

Age, gender, nationality, education, profession, and other demographic attributes are not collected or used in results.

No score here is claimed to be scientifically validated. Independently verify sensitive requests through an official channel.