Check it before you trust it.
Somebody sent you something and it does not feel right. These are 14 free tools for taking it apart — the email, the link, the QR code, the bank details, the attachment. No account, no upload, no signup.
Nothing leaves your browser. Every tool here does its work on your own machine. There is no upload and no server request, which is why it is safe to paste a bank detail, a password or your own email headers into one.
Start with what you were sent
An email that looks wrong
Trace it back to the machine that really sent it, and read its SPF, DKIM and DMARC results.
A link you do not trust
Take it apart and see the real destination before you click, without opening it.
A QR code on a letter or a sticker
Read the address hidden inside it without your phone going there first.
Bank details that changed
Check an IBAN, routing number or card number against its own checksum before you pay.
A password you reuse
See how long it would really last, and whether it is already in a public breach.
A photo you are about to send
See the GPS coordinates and camera serial buried in it, then strip them out.
Why these run in your browser
A tool that checks whether something is a scam is a strange thing to hand your data to. The moment a password, a bank detail or a set of email headers is uploaded, you have to trust the site with exactly the information you were being careful about.
So these do not upload anything. The code runs on your machine, and you can prove it: open your browser's network tab, use any tool, and watch that no request is made. That is also why they keep working with the Wi-Fi switched off.
The one exception is labelled clearly. The password breach check sends the first five characters of a hash — never the password — and does the matching locally. Every tool page says at the top which case it is.
What they can and cannot tell you
Everything here answers a question about form: does this number satisfy its own checksum, what is really inside this QR code, which server actually sent this email. Those have exact answers.
They cannot tell you whether something is honest. A criminal's IBAN passes its checksum. A phishing page has a valid certificate. When money is involved, the answer is always the same: stop, and phone the person on a number you already had — never one printed on the thing that made you suspicious.