Attachment Safety Checker
Not sure about an attachment? Drop it here before you open it. We look at what the file really is, its name, and what’s hidden inside: macros, links to the internet, embedded programs, scripts and fake sign-in pages. Then we tell you in plain English whether it’s safe to open.
- Never uploaded
- Office, PDF, zip, web pages
- Looks inside the file
Check an attachment
Drop a file here, or select to choose one
Save the attachment first (don’t open it), then drag it here. Up to 20 files, 150 MB each. You can also drop a whole saved email (.eml or .msg) to check its attachments.
Save the attachment first (don’t open it), then drag it here. Up to 20 files, 150 MB each. You can also drop a whole saved email (.eml or .msg) to check its attachments.
The file is read by your own browser and is never uploaded, so it’s safe to check private documents. Checking it doesn’t open or run it.
What we check
- What the file really is, from its contents, not its name. A program renamed "invoice.pdf" is caught.
- Disguised names: double extensions (invoice.pdf.exe), hidden right-to-left characters that make a name display backwards, and names padded with spaces.
- Word, Excel and PowerPoint: macros (including ones hidden in a .docx), templates or objects loaded from the internet when opened (the "Follina" trick), embedded packages, ActiveX, DDE fields and old Equation Editor objects.
- PDFs: JavaScript, actions that run on opening, "Launch" actions, attached files, forms that send data and every link inside.
- Zips and saved emails: every file inside, password protection, archives within archives, zip bombs, and we check the files inside too.
- Web pages and SVG images: password boxes, forms that send to other sites, hidden downloads ("HTML smuggling"), disguised scripts and redirects.
- Shortcuts, disk images and OneNote files: favourite tricks for getting past email filters.
Staying safe with attachments
- Be suspicious of urgency. "Invoice overdue", "your account will be closed" and "see the attached remittance" are classic lures.
- Never select Enable Content or Enable Editing in a document you weren’t expecting. That’s what lets macros run.
- A password in the email for a zip or document is a red flag: it stops scanners looking inside.
- Check with the sender by phone on a number you already have, not one from the email. Their account may have been hacked.
- Report it. At work, tell your IT team. In the UK, forward suspicious emails to
report@phishing.gov.uk.
No checker can promise a file is safe: a brand-new attack can look clean. We spot the tricks attackers rely on, and give you a SHA-256 fingerprint to look up on VirusTotal (only the fingerprint is used, never the file). Formats we can’t open, such as .7z and .rar, are flagged so you can be careful.