Lookalike domains
examp1e.org next to example.org, or letters from other alphabets that look the same.
Free & open source · Thunderbird and Outlook
See where a link really goes. Before you click.
Phishing needs just one click. Link Guard shows the real destination of every link in your email, warns you about lookalike domains, misleading link text and hidden redirects, and keeps every decision on your own computer.
- No telemetry
- Nothing uploaded
- MIT licensed
- 0 bytesof your mail sent anywhere
- 8 checksplus your own warning rules
- 20 languagesfollowing Thunderbird’s language
- Signedevery release, with a hardware key
What it catches
The tricks phishing mail relies on, made visible.
Link Guard reads every link the way your mail app would open it, then tells you plainly what is off. Each warning can be switched off, and you can add your own.
Misleading link text
The text says one site, the link leads to another. Link Guard compares both.
Hidden redirects
Links that carry another address inside them, from open redirects to Safe Links and URL Defense wrappers.
Short links
Public URL shorteners hide where you will land. They can only be opened for one message at a time.
Code in links
Script or HTML hidden in a link to a site you trust — the shape of a cross-site scripting attack.
Credentials & raw IPs
User names or passwords inside a link, and bare IP addresses instead of a site name.
Allow- and blocklists
Import up to 20 lists of 5,000 hosts. Remote blocklists update daily, within strict limits.
Your own rules
Warn on any pattern in the host, the address or the link text — on an engine that cannot freeze your mail.
How it works
Nothing opens until you have looked.
No list of “safe” sites is bundled. You decide which sites you trust, and Link Guard holds you to it.
Links wait for you
In Thunderbird, web links in a message stay inactive until their destination is approved. In Outlook, a pane next to the message checks every link.
You see the real destination
A compact notice lists every site the message links to, with the registrable domain highlighted and every warning spelled out.
Approve once, or for good
Allow a site for this message, for always, or a whole domain with its subdomains. A block always wins.
Private by design
Your mail never leaves your computer.
- Checked locallyEvery check runs inside your mail app. No cloud service, no scanning server, no account.
- No telemetryNo analytics, no tracking, no update pings. The developer receives nothing.
- Minimal permissionsRead the displayed message, store your settings. No host permissions.
- Network only when you askThe only requests go to list addresses you add yourself.
Get Link Guard
Pick your mail app.
Same checks, same rules, same promise. Free and open source under the MIT license.
Thunderbird
AvailableLinks stay inactive right in the message until you approve their destination.
- Thunderbird 151 or newer
- Notice above the message, labels next to each link
- 20 languages
Outlook
PreviewA pinned pane next to the message checks every link and opens it only after you approve.
- New Outlook, classic Outlook, Outlook on the web
- Microsoft 365, Exchange and Outlook.com accounts
- Outlook does not let add-ins switch off links inside the message itself
Security
Built to handle untrusted mail.
Untrusted input stays untrusted
Mail is parsed without running scripts. Imported lists are size-bounded, validated, shown for review and start disabled. Blocklists can only take access away.
No catastrophic regex
Warning rules run on a small linear-time engine, not JavaScript's backtracking one, so no pattern can freeze your mail app.
Signed releases
Every release is built only from a tag signed with a hardware security key, and the signature is checked before anything is published.
Questions
Good to know.
Is Link Guard a virus scanner?
No. It is a warning aid for links. An approved site can still serve harmful content, and attachments, QR codes and links inside images are outside its checks. Use it together with your usual protection.
Why is there no list of safe sites built in?
Because any such list would decide for you and could be wrong for you. You approve the sites you actually use; imported lists are optional and always shown for review first.
Does it slow down my mail?
No. Checks take milliseconds, even with 20 imported lists of 5,000 hosts each.
What does it cost?
Nothing. Link Guard is free and open source under the MIT license, with no ads and no paid tier.
How do I report a security problem?
Privately, through GitHub's vulnerability reporting, as described in the security policy.
Look before you click.
Install Link Guard in a minute. It stays out of your way until a link deserves a second look.