Can you spot the phishing message?

    Work through realistic examples and decide whether each message is suspicious. In real life, verify unexpected requests through a separate trusted channel.

    Example 1 of 5

    From: security@micros0ft-support.com

    Account closes today

    Confirm your password within two hours to keep access.

    How to interpret the result

    Treat this tool as one input, not a security verdict. Results can be incomplete because browsers restrict access, services change, and a safe result now does not predict future compromise. Confirm important findings through account settings, provider notices and independent checks.

    What to do next

    Use unique credentials, enable multifactor authentication, install updates and verify unexpected requests independently. If money, sensitive records or a work system may be affected, preserve evidence and contact the appropriate provider or qualified professional.

    Privacy note

    Do not paste an existing password into this site. The password generator works locally. The public-IP check calls an external lookup endpoint when you press its button. The breach check sends only the address you type to our lookup service, which queries the Have I Been Pwned breach database; the address is never stored in plain text.