Verifier: check a link is genuine

SafeHanded

Check a link

Paste a link you were sent to confirm it is a genuine SafeHanded link and see who issued it. We never open the link or reveal what is inside.

Try an example:

The part of the link after the # (the secret) is stripped in your browser and never sent to us. Tip: type safehanded.com/check yourself rather than trusting a link in a message.

Reading the result

Three answers, in plain English.

Genuine

Issued through SafeHanded and still live. For a verified issuer we name the organisation and the domain they've proven they control.

No longer active

It was a real SafeHanded link, but it's already been used, has expired, or was revoked. There's nothing to submit, it's safe to close.

Not SafeHanded

We can't recognise it as a SafeHanded link, it may be a look-alike. Don't enter anything; check with your IT contact through a channel you already trust.

How it works

Private by design.

The Verifier is built so that checking a link can never expose a secret, not to an attacker, and not to us.

The secret never leaves your browser. The part of a SafeHanded link after the # holds the decryption commitment; it's stripped locally, so only the harmless token is ever checked.
It runs on an isolated read model. The Verifier reads a separate index with no access to any tenant's requests, envelopes or keys, a breach of it would expose nothing usable.
Verified issuers are named. A paying organisation that has proven control of a domain is shown by name; an unidentified issuer is flagged so you stay cautious.
It's the same tool we ship in-product, and on every genuine handover page there's a reminder to come here and check.

For IT & MSP teams

Give your users a link they can verify.

Every SafeHanded handover is branded, domain-verified and checkable, so "is this really IT?" has an answer.

Start free Read the security model