Reveal URLs
Spot phishing links before you click.
A phishing email hides a hostile destination behind trustworthy-looking link text. The visible text may read paypal.com while the link actually points at paypa1.com or another look-alike host. The text can lie; the real destination cannot.
Reveal URLs is a small browser extension and Thunderbird add-on, and it also comes as an Outlook add-in and a Gmail add-on, that reads each link in the message you are reading and shows you its real destination host. When the host named in the link text disagrees with where the link actually points, it flags the mismatch, so you see it before you click. The browser extension and Thunderbird add-on do everything on your device and transmit nothing. The Outlook add-in analyses your messages on your device and sends no email data anywhere — but its task-pane code is loaded from Codeberg Pages over HTTPS, like any web page. The Gmail add-on runs on Google's servers. There are no analytics and no tracking.
Supported browsers, mail client and email add-ons
- Chrome
- Edge
- Opera
- Firefox
- Thunderbird
- Gmail
- Outlook
A Safari build is not yet shipped; it is planned for a later phase.
Why this matters
Mail and web apps too often show only the link text and hide the real URL, which is exactly what a phishing link relies on. For the reasoning behind always showing the destination, see Email link phishing: your app should always show the URL.
Install
Store publication is pending, so there are no live store links yet. Reveal URLs is coming to:
- the Chrome Web Store
- Microsoft Edge Add-ons
- the Opera add-ons site
- Firefox Add-ons (AMO)
- Thunderbird Add-ons (ATN)
- Google Workspace Marketplace (Gmail add-on)
- Microsoft AppSource (Outlook add-in)
Until then, you can build and load it yourself; see the install and build steps in the Manual.
Links
The browser extension and Thunderbird add-on do everything on your device and transmit nothing. The Outlook add-in analyses your messages on your device and sends no email data anywhere — but its task-pane code is loaded from Codeberg Pages over HTTPS, like any web page. The Gmail add-on runs on Google's servers. Read the full privacy policy.
Reporting an issue
Found a bug, a link Reveal URLs flagged wrongly (or missed), or a webmail host it should support? Please open an issue on the Codeberg issue tracker. Including the browser or mail client, the version (shown in the footer and on the options page) and a short description helps a great deal.