URLCheck

Every link you tap is a small act of blind faith. A button in a newsletter, a shortened URL in a social post, a “check this out” from a friend: you press it, and Android hands it straight to a browser or app without asking anything. Tracking parameters, affiliate tags and redirect chains all get waved through with it.

URLCheck, from independent developer TrianguloY, puts a pause into that reflex. The idea: set it as your default browser. When a URL is tapped in email, chat or social media, URLCheck catches it first and shows a compact window describing what’s about to open. From there the link can be edited, cleaned, inspected, shared, or passed to whichever app the user chooses.

The pitch is refreshingly blunt. The app is free, open source, has no ads or trackers, and requests exactly one permission: internet access. That combination is rarer than it should be, and it explains the app’s quiet following. The app is also distributed through F-Droid and IzzyOnDroid, the storefronts where privacy-minded Android users tend to shop. Unusually, the project is released under CC BY 4.0, a Creative Commons license more often seen on documentation than on code.

Its market position is almost anti-commercial. There’s no premium tier, no subscription and no cloud account. Commercial “safe browsing” products usually fold link scanning into a security suite that wants broad device access and a recurring fee. URLCheck goes the other way. It’s a single-purpose tool built from swappable modules, it does its work on the device where it can, and it’s transparent about when it has to reach outside. It’s built for people who already care where their clicks go — and, it’s fair to argue, for plenty of people who should.

• Modular Architecture: Every capability is a module that can be turned on, turned off and reordered. The interception window shows only what’s been chosen.
• URL Cleaner: Strips tracking and referral parameters using the community-maintained ClearURLs rules, the same ruleset behind the popular browser extension.
• Unshortener: Expands short links so the real destination is visible before committing.
• Queries Remover: Breaks a URL into its individual query parameters so each can be inspected or deleted one at a time.
• Status Code: Fetches the link and follows its redirects to show where it actually lands.
• URL Scanner: Checks links against VirusTotal, but only with a user-supplied API key.
• Hosts Checker: Flags domains that appear on known lists of malware, adware, fake-news, gambling and adult sites.
• Pattern Module: Uses regex rules to warn about lookalike non-ASCII characters used in phishing, and suggests HTTPS upgrades. It can also redirect YouTube, Reddit and Twitter links to privacy-friendly front-ends. That option is off by default.
• History, URL Log and Open: Undo/redo for edits, a log of processed links, and a launcher for choosing which app opens or shares the result.

The Interception Loop

URLCheck’s core loop is simple: tap, inspect, decide. A link that used to open instantly now produces a window, and one more action is required before anything loads. That extra step is the whole product, and it’s also the biggest thing a user has to accept.

For some people this is a feature worth having a dozen times a day. Watching a sixty-character URL collapse into something clean, or noticing that a “bank” link resolves to an unfamiliar domain, builds a kind of link literacy that browsers have spent years trying to hide. For others, the added step will wear thin by Thursday. URLCheck doesn’t pretend otherwise. It’s a deliberate speed bump, and it should be installed with that understood.

The Open module makes the loop work. Because URLCheck sits where the browser normally sits, it has to send the link somewhere, and it lets the destination app be picked each time. That effectively replaces Android’s generic chooser with a smarter one. A work link can go to one browser and a personal link to another, or a cleaned URL can be shared without opening it at all.

Cleaning and Unmasking

The URL Cleaner is the module most people will leave on permanently, and it earns that spot. Leaning on ClearURLs rather than writing its own rules is the right engineering call. It means URLCheck benefits from a ruleset that’s already widely deployed and maintained. The trade-off is that the cleaner is exactly as good as those rules. Novel tracking schemes will slip through until the community catches them.

The Queries Remover is the power-user companion. It lays out each parameter separately, which is useful and also instructive. Seeing how many identifiers ride along on an ordinary shopping link is a quick lesson in how the ad-tech plumbing works.

The Unshortener and Status Code modules answer the most important question about any link: where does it actually go? But this is also where URLCheck’s honesty about trade-offs matters most. To learn a link’s destination, something has to contact it. When Status Code fetches a URL and follows its redirects, the server on the other end sees a request. For most links that doesn’t matter. For a phishing message that uses a unique link per recipient to confirm an address is live, the check itself can be the signal the sender wanted. Run it deliberately, not reflexively.

Security Checks: Useful, With Caveats

The security modules are uneven, and the reasons are instructive.

The Pattern module’s homograph detection is the standout. Phishing domains that swap a Latin “a” for a Cyrillic “а” are almost impossible to spot by eye. A rule that simply flags non-ASCII characters in a domain catches a whole class of attack that people reliably miss. It’s cheap, it runs locally, and it’s genuinely protective.

The Hosts Checker is blunter. List-based blocking works well against known offenders and does nothing against a domain registered this morning. Its categories also go beyond security into judgment calls. “Fake news” and “gambling” are editorial labels, and the warnings are only as good as whoever curated the lists. Treat its flags as prompts to think, not verdicts.

The URL Scanner is the module to approach most carefully. Requiring a personal VirusTotal API key creates real onboarding friction, and most casual users will never set it up. The bigger issue is that submitting a URL to VirusTotal sends it to a third party whose submissions are visible to its security community. That’s fine for a suspicious link in a spam text. It’s a bad idea for a password-reset link, a private document share or anything else with a token in it. URLCheck makes the scanner opt-in, which is the right default, but the app could do more to explain what’s at stake.

The privacy redirects for YouTube, Reddit and Twitter ship disabled, which is wise. Privacy front-ends for these services are notoriously unstable. Public instances appear, get rate-limited or blocked, and disappear. Turning this on means signing up for occasional maintenance.

Configuration: Power at a Price

The modular design is URLCheck’s best idea and its steepest learning curve. Reordering modules lets a user build a pipeline that matches how they think: clean first, then check patterns, then decide whether a network check is worth it. But the app gives that control without much guidance. Anyone who doesn’t already know what a query parameter or a redirect chain is will face a settings screen full of capable tools with little explanation of when to use each one. The defaults matter enormously here, and newcomers would benefit from a guided first-run setup that explains the privacy trade-off of each network module.

URLCheck looks like what it is: a utility built by a developer who cares more about function than polish. The interception window is a dialog laid over the app the link came from, not a full-screen takeover. That’s a smart choice, because the context of the source app stays visible while the decision is made. Modules stack vertically in the order they’ve been set. The more that are enabled, the taller the window gets — with a full set turned on, a dialog meant to be glanced at becomes one to scroll.

It isn’t pretty, and it isn’t trying to be. The design is utilitarian, dense and honest: clear labels, visible data and no decorative padding. Whether that reads as clean or crude depends on tolerance for interfaces that look like settings panels.

By design, performance depends on which modules are used. Local operations like rule-based cleaning, pattern matching and parameter editing need no network round trip, so they run without delay. Anything that reaches the network, such as Status Code, the Unshortener or the VirusTotal scanner, adds latency tied to the connection and the remote server, and that’s where the speed bump gets taller. The footprint is light, there are no background trackers, and the single-permission model means the app has very little room to misbehave.

URLCheck exists because Android allows it to. Android lets a third-party app register as the default handler for web links, and that’s the hook the app hangs on. iOS restricts which apps can become default browsers, so a tool like this is much harder to build there. That makes it an Android-only proposition, and arguably one of the better arguments for Android’s openness.

The hook has gaps, though, and prospective users should understand them:

• Verified app links skip it. On modern Android, domains that have verified their association with an installed app (YouTube is the obvious example) can open directly in that app without passing through the default browser. URLCheck never sees those links.
• In-app browsers bypass it. Social and messaging apps that open links in their own embedded browser never hand the URL to the system, so URLCheck can’t intercept it. Sharing the link to URLCheck manually is the workaround, and it’s clumsy.
• Touch ergonomics are considered. The dialog is laid out for one-handed use, with actions close to where a thumb already rests. The main exception is when a long module stack pushes controls off-screen.

URLCheck is a rare kind of software: a tool with a clear point of view that doesn’t hide its trade-offs. It assumes the moment between tapping a link and loading it deserves scrutiny, and it provides a well-chosen set of instruments for that moment. ClearURLs-based cleaning and homograph detection deliver real protection at essentially no cost. The network modules are powerful but come with privacy costs that a less honest app would hide behind a “scan” button.

Its weaknesses are real but bounded. The interface is plain, the configuration expects users to know what they’re doing, and Android’s own link-routing rules leave gaps the app can’t close. None of that changes the core judgment: this is solid, honest software with flaws that matter mainly to impatient users. For an app that costs nothing, shows no ads, collects nothing and asks for one permission, it delivers plenty. For anyone who has wondered what’s hiding in the links they tap, it’s worth installing — turn on the cleaner and the pattern checks, and leave the network modules for when they’re actually needed. Everyone else can live without it.