Free Windows Tool

Catch Phishing Links
Before They Load

LinkGuard is a Windows system tray app that silently monitors URLs — from your clipboard and every link you click — and warns you before a phishing page can load.

Get LinkGuard on GitHub
FreeOpen SourceWindows 10 / 11System Tray

The Problem

Phishing links don't look dangerous. A password-reset email, a shipping notification, a shared document — one click and the fake login page is already loading. The tricks are old but effective: paypa1.com instead of paypal.com, a real brand name buried in a subdomain like paypal.evil.com, a URL shortener hiding the final destination, or a raw IP address dressed up with a familiar-looking path.

By the time you notice, the page has loaded. LinkGuard sits in the system tray and checks the URL first — the moment you copy it, or the moment you click it — and warns you before your browser ever opens the page.

What It Does

LinkGuard scores every URL across 12+ heuristic risk signals — no API key required. Raw IP hostnames, @ credential-embedding tricks, homoglyph typosquats, brand names in subdomains, punycode domains, URL shorteners, high-risk TLDs, open redirect parameters, excessive subdomain depth, suspicious path keywords, and unencrypted HTTP on sensitive paths all add to the score. URLs land in one of three risk levels: Clean, Suspicious, or Phishing.

Clipboard Monitoring
Detects URLs as soon as you copy them — the clipboard is polled every 600 ms, and you can pause monitoring from the tray at any time.
Link Interception
Optionally registers as the system http/https handler so every clicked link is checked before your browser opens it — no admin rights required.
Optional API Checks
Add a free Google Safe Browsing or VirusTotal API key for reputation checks on top of the heuristics. Both are optional — heuristics run without any keys.
Whitelist / Blacklist
One click to always allow or always block a domain, straight from the alert dialog. Blacklisted domains are silently blocked going forward.
History Log
A log of every URL checked, with its score and the action taken — so you can review what LinkGuard caught and what you allowed.
Silent & Private
No console window, no telemetry. Runs in the background from the tray, can start with Windows, and keeps all data local in %APPDATA%\LinkGuard.

Install

LinkGuard is free and open source (MIT). It requires Python 3.12 on Windows 10 or 11.

git clone https://github.com/VAROIndustries/LinkGuard.git cd LinkGuard pip install -r requirements.txt pythonw LinkGuard.pyw

Or double-click LinkGuard.pyw in Explorer — it runs with no console window. To build a standalone .exe, run build.bat.

Source and documentation: github.com/VAROIndustries/LinkGuard

FAQ

How does LinkGuard detect phishing links?
LinkGuard scores every URL across 12+ heuristic risk signals — raw IP hostnames, homoglyph typosquats like paypa1.com, brand names hidden in subdomains, punycode domains, URL shorteners, high-risk TLDs, open redirect parameters, and more — with no API key needed. Optional Google Safe Browsing and VirusTotal integrations add reputation checks on top.
Can LinkGuard check every link I click, not just the clipboard?
Yes. Enable "Intercept all http/https link clicks" in Settings and LinkGuard registers itself as the system URL handler under HKEY_CURRENT_USER — no administrator rights needed. Every link you click in any application is checked before your browser opens it, and unchecking the setting restores your previous default browser automatically.
Does LinkGuard send my URLs anywhere?
No. There is no telemetry — your whitelist, blacklist, history, and settings live locally in %APPDATA%\LinkGuard\linkguard.db. URLs are only sent externally if you choose to configure a Google Safe Browsing or VirusTotal API key, and then only to that API endpoint.
What happens when LinkGuard flags a suspicious URL?
A popup shows the risk level, a score bar, and the specific findings. From there you can open the URL anyway this one time, always allow the domain (whitelist), block the domain (silently blocked going forward), or dismiss the alert.
Is LinkGuard free?
Yes — LinkGuard is free and open source under the MIT license. It runs on Windows 10 and 11, requires Python 3.12, and the full source is on GitHub. A build.bat script is included to build a standalone .exe.

More Free Tools

SharePointYankee
Over a decade of SharePoint, Azure, and Microsoft 365 scripts and snippets in one repo.
KillSwitch
Kill every messaging, video, VPN, and social app in one click before you share your screen.
PlainText
Strip clipboard formatting automatically — paste clean text every time.
All Apps & Tools →
The full VARØ suite — maker tools, developer utilities, vendor apps, and more.