Home / Tools
Free tools
Small, single-purpose checkers for the email problems that are easier to answer with a tool than with a paragraph. Every one runs entirely in your browser.
Nothing you type is sent anywhere. These tools contain no network requests at all. Nothing is logged, nothing is stored, and there is no sign-up. You can confirm it by opening your browser developer tools and watching the network tab while you use them.
2 tools
All tools
Built because the answer was genuinely hard to give in prose, not to have tools.
Phishing
Sign-in URL checker
Paste a sign-in address and find out whether it genuinely belongs to Microsoft, Google or Yahoo. Catches the subdomain trick, lookalike characters, punycode and raw IP addresses.
Updated Aug 16, 2026Open the tool
Account safety
Account recovery checker
Could you actually get back into your mailbox if the password stopped working? Scores your recovery methods on independence rather than count, and tells you what to fix first.
Updated Aug 27, 2026Open the toolWhich one do you need?
You have a sign-in page or a link in front of you and you are not sure it is genuine. Use the sign-in URL checker. Paste the address before you type a password into it.
You can still get into your mailbox, and you want to know whether you could get back in if the password stopped working. Use the account recovery checker. This is the one to run while nothing is wrong, because every recovery method has to be added while you still have access to the account.
You have already lost access. Neither tool will help, and we would rather say so than waste your time. Go straight to the walkthrough for your provider: recovering a Hotmail or Outlook account, or recovering a Gmail or Google account.
What each tool actually inspects
The sign-in URL checker reads the address and nothing else. It looks for the four things that let a fake sign-in page survive a glance:
- Whether the registrable domain really is
microsoft.com,google.comoryahoo.com, rather than a name that merely contains one of those words somewhere inside it. - The subdomain trick.
login.live.com.attacker.netcontains a genuine Microsoft domain and belongs entirely toattacker.net. - Punycode homographs, where a Cyrillic character renders as its Latin twin and the address looks correct at any font size.
- Raw IP addresses standing in for a hostname, and pages served over
httpinstead ofhttps.
The account recovery checker scores the methods on your account for independence rather than for how many there are. Three recovery routes that all depend on the same phone are one route. It flags a recovery address that lives on the very account you would be locked out of, and it tells you which single thing to fix first.