Phishing Email Analyser
Paste a suspicious email — the message text, the full headers, or both — and see every phishing and social-engineering warning sign it contains, with a transparent 0–100 risk score that shows exactly where each point came from. It’s an educational triage tool: it highlights red flags, it can’t prove an email is safe or malicious.
Runs 100% in your browser. Your email is analysed on this device and is never uploaded, stored or sent anywhere — not to a server, an AI service or analytics. This page is technically blocked from making any network request, and there is no tracking. You can even disconnect from the internet after it loads.
Never click a link or open an attachment just to test it. Copy the text instead. If a message might be genuine, contact the organisation through its official website, app, or a phone number you already trust — never the contact details in the email.
How the score works
There is no black box. Each warning sign below has a fixed point value. When a sign is found, its points are added once (repeating the word “urgent” ten times still counts once), and the total is capped at 100. Reassuring signs such as passing SPF, DKIM and DMARC are shown, but they never subtract points — attackers can send from properly authenticated domains too.
- Low Risk0–29 points — few common warning signs. Still verify anything unexpected.
- Suspicious30–59 points — several warning signs. Verify before you act.
- High Risk60–100 points — multiple strong indicators. Treat as hostile.
Every rule and its points
| Points | Warning sign | Area |
|---|
FAQ
Is my email uploaded anywhere?
No. All analysis is plain JavaScript running on your device. The page carries a security policy that forbids it from making network requests or submitting forms, and it loads no analytics or third-party scripts. Nothing is saved either — refresh the page and the text is gone.
Does a low score mean the email is safe?
No. The analyser looks for common, well-known warning signs. A careful attacker — especially one sending from a genuinely compromised account — can avoid all of them. Equally, some legitimate emails trigger rules (real invoices mention payment). Use the score to decide how carefully to check, then verify through a channel you already trust.
Does it open the links or attachments?
Never. Links are read as text and shown “defanged” (for example hxxps://example[.]com) so they
can’t be clicked by accident. Attachments are judged only by the file name that appears in the text. If you need to
see where a link leads without visiting it, the Redirect Tracer can follow it from a
server — note that tool does send the URL to the scanner.
What are SPF, DKIM and DMARC?
They are email authentication checks your mail provider records in the Authentication-Results header.
SPF checks the sending server is allowed to send for the domain, DKIM checks a
tamper-proof signature, and DMARC checks those line up with the From address you see. They only appear
if you paste the full headers.
I think it’s phishing. What should I do?
Don’t reply, click or open anything. Use your mail app’s “Report phishing” button, tell your IT or security team if it arrived at work, and delete it. If you already clicked or entered details, change that password straight away from the real website, enable multi-factor authentication, and contact your bank if payment details were involved. In Australia you can also report it to Scamwatch or ReportCyber.