See where a link really goes before you tap it.

A free Chrome extension that shows where a link really goes before you click it. It follows short links and redirects, checks the link against public phishing and malware lists, and asks Jev, TypeSafe AI’s decision model, about links no list knows. If a link looks like a scam, Peekray warns you and asks before opening it. From version 1.7.0 it also warns before you type a password, card details or a one-time code into a page that presents itself as a brand Peekray knows but isn’t on that brand’s site.

Yes. LinkGuard was renamed Peekray in October 2026. It’s the same extension on the same Chrome Web Store listing, so if you already have it, it updates by itself.

Rest your pointer on it with Peekray installed, or paste it into the checker on this page. Peekray follows the link to where it really lands, looks it up in public phishing and malware lists, and gives you a clear answer such as Safe, Check first or Scam.

Yes. There is no account and nothing to pay.

Chrome’s Safe Browsing warns you when you open a page on Google’s list of known dangerous sites. Peekray works earlier: it shows where a link goes while you hover, checks it against three public phishing and malware lists, and has Jev judge links no list knows yet. They work well together, so keep Safe Browsing switched on.

Yes, through the website. Paste a text, email or link into it and it checks the links in it (up to 8). On Android, add Peekray to your home screen from Chrome and you can also share messages and links to it. On iPhone, add it to your home screen from Safari, copy the message and tap Paste and check. You can also choose a screenshot of a message, which is read on your phone, or scan a QR code with the camera or pick a photo of one. Only the web addresses in a message, screenshot or QR code are sent for checking.

Yes, on your phone. Open the phone page, tap Scan with camera and point it at the code, or pick a photo or screenshot of one. The code is read on your phone and only the web address in it is checked. Codes that aren’t web addresses, like Wi-Fi logins or payment details, stay on your phone.

No. Peekray sends nothing from the page but the link you hover, focus or click, that link’s text, and the page title (with email addresses and long numbers taken out). It never reads form fields, passwords or cookies, and nothing else from the page is sent. From version 1.7.0, when you move into a password, card or one-time-code field, it also looks, on your own device, at what the page says about itself (its title, site name, logo text and headings) and what its fields ask for. If the page presents itself as a brand Peekray knows but isn’t on that brand’s site, it warns you before you type. Nothing from that check is sent, and it never reads what you type. From version 1.7.2, each check it sends also carries one word for how it started (resting on the link, the keyboard, a click, the right-click menu or the popup’s “Check a link” box), which goes only into daily totals.

OpenPhish, PhishTank and URLhaus, three public lists of reported phishing and malware links. Peekray keeps a copy on its server, refreshed about once an hour while Peekray is in use and at least once a day, so looking a link up never sends it to the list providers.

No tool does. Some links get a grey “Check first” instead of Safe even when Peekray finds no scam signs: pages on free site builders, shared documents and other places where anyone can publish, some sites that use the name of a delivery firm or other big name Peekray knows, without being its site, and sites the registry says were registered in the last 30 days. If Jev can’t answer, only well-known sites are called Safe. If it gets a link wrong, tap “Wrong answer?” under the result (or “Wrong?” in the extension’s popup) to tell us. Keep your browser’s own protection switched on too.

When you ask for a deep check, Peekray’s server fetches the page the link lands on once, reads up to 512 KB of it with no scripts run, and looks at the site’s certificate, hosting and DNS records. If the page is built by scripts and shows nothing, or almost nothing, without them, Peekray may open it once more in a locked-down browser on a separate, throwaway machine that holds none of Peekray’s keys, let the scripts build it for a few seconds and read the result; nothing is typed, clicked or submitted. Your browser never opens the page. It keeps what it found, such as that the page asks for a password, names a brand or sits on a certificate issued yesterday, for an hour, and never the page’s text. Jev is shown those signals and the page’s title and headings with email addresses and long numbers removed, not the page itself. Links that carry a personal code, like a sign-in, password-reset or unsubscribe link, are never fetched. If you run a deep check in the extension’s toolbar popup, the extension keeps the answer and its evidence lines until you close the browser.

When you send Peekray’s answer to someone, you can add a page of it at peekray.com/r/ followed by a random code, which anyone with the address can open for 30 days. Peekray makes it from its own check of the link, never from what your browser says, so a page can’t claim something Peekray didn’t find. It holds the website the link names and the one it lands on, as site names, the answer, the reasons and red flags, what the check did, and the deep check’s evidence lines if one ran. It never holds the link itself, its text, the message it came in, the page Peekray read, or anything about you. After 30 days it’s deleted.

If you use Chrome’s Enhanced protection, Chrome shows that note on extensions from developers who are new to the Chrome Web Store, and Peekray is new. It isn’t a finding that Peekray is harmful. Google says new developers generally become trusted after a few months of following the store’s rules, and every Peekray version is reviewed by Google before it’s published. What Peekray sends is listed under “Does it read my passwords?” above.

Yes. Peekray’s server follows short links and redirects, up to four hops, and shows where they land, so you see the real site before your browser goes anywhere.

A second, slower look you can ask for after the quick answer, on the website or, from version 1.7.1, in the extension’s toolbar popup. The quick look judges the link itself: the address, the redirects, the threat lists and Jev’s first answer, in about a second. A deep check then reads the page the link lands on (on Peekray’s server, never in your browser), checks the site’s certificate, hosting and records, compares what the page claims to be with what the address says, and asks Jev again. The answer comes as an evidence card: every reason in Peekray’s own words, labelled Page, Certificate, Hosting, Records, Message, Lists, Address or Jev, strongest first. It can confirm a warning, raise one, or clear a “Couldn’t fully check” to Safe, but a red flag in the link never gets talked down. It takes a few seconds, and there is a daily limit, so Peekray offers it rather than running it every time.

Links that point away from the host you’re on (another site, or another part of it like shop.example.com), and same-host links that carry another site’s address (like /url?q=…), including links inside frames and most web components. Links inside other apps, and javascript: or data: links, aren’t checked.

A click waits up to 2.5 seconds for a verdict. If none arrives and the address itself has warning signs (a short link, an unusual ending, an IP address), Peekray asks before opening. Otherwise the click goes through, so browsing never gets stuck.

Yes. Click the Peekray icon in the toolbar and switch off “Checks on this site”.