Is that e-mail
safe…or
fake?
Forward any suspicious e-mail to our AI agent. It reads the headers, the links and the language a filter would miss — and sends back a verdict you can actually understand.
Contents are redacted straight after analysis. We never sell your data, and we set zero tracking cookies.
From: payroll-hr-secure[.]net
Action required: confirm your payroll details
Credential phishing impersonating a payroll portal.
Three steps. No signup.
HOW IT WORKSForward it
Send the suspicious email straight from your inbox to check@safeorfake.com.
The agent reads it
Headers, link domains, tone and intent — read in seconds, not matched against a blacklist.
Get the verdict
A plain-English report back in your inbox: safe or fake, and exactly what gave it away.
Filters match lists.
We read intent.
A brand-new phishing domain is invisible to a blacklist for hours. It isn't invisible to a model that understands what the message is trying to make you do.
Check your first email →Questions people ask first.
FAQ
Is SafeOrFake free?
Yes. Forwarding a suspicious email for analysis is free and needs no account, and there is nothing to install.
Do I need to create an account?
No. Forward the message from whatever mail client you already use, and the report comes back as a reply to the address you sent it from.
How long does an analysis take?
Typically under 30 seconds. The reply arrives in the same inbox you forwarded from, so there is nothing to check back on.
What does the analysis actually check?
Three things a filter cannot weigh together: the headers, including the true origin of the message and whether SPF, DKIM and DMARC align; the links as written — the domains they name, how those are spelled and whether they belong to the brand being claimed; and the language of the message itself — the pretext, the pressure and the ask.
How is this different from my spam filter?
A filter matches a message against lists of known-bad senders, domains and signatures. A domain registered an hour ago is on no list yet. SafeOrFake reads what the message is trying to make you do, so a campaign nobody has reported before is not invisible to it.
What happens to the email I forward?
Once your report has been delivered, the message is destroyed on our mail server and its contents — the sender, the subject, the body, the links and the headers — are redacted from our records. What is kept is campaign evidence that identifies nobody, and that record is permanently deleted after 90 days.
Read the full privacy policy →
Can I forward an email I already replied to?
Yes, and it is worth doing. The analysis describes the message, not what you did with it — and knowing a message was a phishing attempt is what tells you which passwords to change and what to watch for next.
Safe or fake?
Forward one email and find out. It takes less than a minute and costs nothing.