Spot phishing links before you click.

A phishing email hides a hostile destination behind trustworthy-looking link text. Sometimes it is a look-alike host: the text reads paypal.com while the link points at paypa1.com. Often it is subtler, routing through a tracker or redirector, so where you land is nothing like the brand named in the text. Reveal URLs shows the URL each link really points to, so the mismatch is plain to see.

This is not hypothetical. The message below is a real phishing email dressed up as a parcel-delivery notice from a postal service:
![A phishing email impersonating a postal service, claiming a parcel is held until unpaid customs charges are paid and urging payment via a “Go to payment” button. Reveal URLs shows the button does not point to that postal service but to parcel-pay.custom.co.xa, an unrelated site, exposing the message as a scam.](https://www.twine.net/signin
Reveal URLs exposes the “Go to payment” button: it points to parcel-pay.custom.co.xa, not the postal service it impersonates.
Note: This screenshot shows a fraudulent phishing email impersonating a postal service. The impersonated service is not affiliated with Reveal URLs and does not endorse it.

[Reveal URLs](https://www.twine.net/signin is a small browser extension and Thunderbird add-on, and it also comes as an Outlook add-in and a Gmail add-on, that reads each link in the message you are reading and shows you the URL it points to. When the host named in the link text disagrees with where the link actually points, it flags the mismatch, so you see it before you click. The browser extension and Thunderbird add-on do everything on your device and transmit nothing. The Outlook add-in analyses your messages on your device and sends no email data anywhere — but its task-pane code is loaded from https://www.twine.net/signin over HTTPS, like any web page. The Gmail add-on runs on Google’s servers. There are no analytics and no tracking.