RawHTTP
Sign In

Terms of Service

Last updated: August 22, 2026

These terms cover rawhttp.com and rawphish.com (“the service”), operated by RawHTTP (“we”, “us”). Using the service means you accept them. If you do not accept them, do not use the service.

1. What the service does

You give us a web address. Our servers open it, follow any redirects, and report what we observed: where it ended up, the HTTP headers, the page source, security certificate details, and a screenshot of the page. rawphish.com reports the same check in plain language for people who are not security analysts.

2. The service does not tell you whether anything is safe

We report observations, not verdicts. A check that turns up no warning signs is not a statement that a link, file, page, or company is safe, legitimate, or trustworthy.

A website can behave differently for us than it will for you. It can recognize our servers and show us a harmless page, refuse to load for us entirely, or change minutes after we looked. A check we could not complete says nothing about the site, since scam sites routinely hide from checkers.

Never treat a check as permission to trust a link, enter a password, send money, or open a file. Decisions about what to trust are yours, and so are the consequences.

3. Acceptable use

Do not use the service to:

  • attack, scan, probe, load-test, or overwhelm any website or network;
  • harass anyone, or generate traffic to a site in order to disrupt it;
  • work around rate limits, whether by using multiple addresses, multiple accounts, or automated tools;
  • resell the service, or present it as your own;
  • do anything illegal, or anything that breaks another party’s terms.

We may block any address, account, or URL at any time, without notice and without explanation.

4. What you submit

You are responsible for the addresses you submit. Submitting one causes our servers to send a request to a third party’s website; it is on you to be sure that is something you are entitled to do.

Do not submit addresses that contain passwords, session tokens, or private one-time links. A password reset link, sign-in link, or invitation can be spent, invalidated, or recorded simply by being opened, including by us opening it on your behalf.

5. Content from other websites

What a check returns is content published by someone else. We do not own it, endorse it, or vouch for it. Screenshots and page source can contain other people’s copyrighted material, trademarks, and personal information; how you use what you get back is your responsibility.

6. Accounts

You are responsible for your account and for everything done through it, including keeping your sign-in details secure. Give us accurate information and keep it current. We may suspend or remove any account.

7. Paid features

Parts of the service may be offered on paid or usage-limited terms. Where they are, the price, billing period, and any limits will be stated at the point of purchase, and those terms apply in addition to these. We may introduce, change, or discontinue paid features, and we may change what is available without charge.

8. Availability

The service is provided on a best-effort basis. There is no uptime commitment. We may change, limit, suspend, or shut down any part of it at any time.

9. No warranty

The service is provided “as is” and “as available”, without warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, non-infringement, accuracy, or completeness. We do not warrant that the service will be uninterrupted or error-free, or that anything it reports is accurate, current, or complete.

10. Limitation of liability

To the fullest extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost data, or losses of any kind arising from your use of the service or your reliance on anything it reports, including a decision to trust or to distrust a link. Our total liability for any claim relating to the service will not exceed the greater of one hundred US dollars or the amount you paid us for the service in the twelve months before the claim arose.

Some jurisdictions do not allow certain exclusions or limitations, so parts of this section may not apply to you.

11. Indemnity

You agree to indemnify and hold us harmless from any claim, loss, or demand arising from your use of the service, from the addresses you submit, or from your breach of these terms.

12. Changes

We may update these terms. The date at the top changes when we do, and continuing to use the service means you accept the current version.

13. Contact

Questions, abuse reports, and takedown requests: contact@rawhttp.com.

© 2026 RawHTTP Terms Transparency

Settings

Settings are saved in your browser's localStorage. Sign in to sync across browsers.

Dark Mode?

Custom Pivot Services

TypeNameURL

About RawHTTP

RawHTTP.com was created to help in the investigation of suspicious links.

Submitted URLs and screenshots are not saved as reports, and there is no search history. A submitted URL can appear briefly in ordinary server logs, as described on our transparency page. Save the screenshot if you want to keep it, since running the same check again fetches a new one.

Warning

If the URL entered performs some action, for example unsubscribing from a mailing list, those actions will still be taken. Information in the URL, such as personal information or other identifiers, is sent along with the request.

Limitations

Domains containing [.] will be replaced with a single dot and [:] in the scheme will be replaced with a colon. This reduces friction when pasting defanged URLs.

HTTP Headers

Shows the chain of requests to reach the destination, including any redirects with their status codes, plus HTTP response headers for each hop.

Certificate

Shows the TLS certificate presented by the destination: subject, issuer, validity dates, serial number, and Subject Alternative Names. Certificate retrieval does not verify trust, so expired, self-signed, and mismatched certificates are still shown. Click "Download Certificate" to save the raw certificate.

Signals

Facts extracted automatically from the destination page and its certificate. Items flagged here are worth a closer look, not a verdict.

TLS Warnings

Flags certificate and connection problems, including hostname mismatches, expired or not-yet-valid certificates, self-signed certificates, missing Subject Alternative Names, weak signature algorithms or key sizes, deprecated TLS versions, and weak cipher suites.

Page Identity

Title, Open Graph title and site name, meta description, keywords, and meta refresh redirects reported by the page.

Forms

Every form on the page, including its method, action, and fields. Flags a password field and an action that posts off-domain, since that combination is common in credential-phishing pages.

Iframes & Scripts

Every iframe on the page, flagged if it is cross-domain or hidden, and every externally-hosted script the page loads.

Cookies

Cookies the page attempts to set, flagged if they are missing httpOnly, missing secure, or set with SameSite=None.

Image & PDF Metadata

If the destination is an image or PDF rather than a web page, shows its metadata instead: dimensions and EXIF/GPS data for images, or title, author, producer, and page count for PDFs.

Screenshot

Shows what the page looks like in a browser. Useful for safely inspecting suspected phishing pages. Click the screenshot to open a full-size version in a new tab.

Source

Displays the full HTML of the resulting page. Click "Add Syntax Highlighting" to make it easier to read. Note this may be slow on large pages.

Resources

All resources the destination URL requested: stylesheets, images, scripts, and more.

Console

Browser console messages from loading the destination URL, as you would see in developer tools.

Custom Pivot Services

Under Settings, add third-party web resources to pivot a URL, Domain, or IP to. Use %s where the indicator should appear. Saved in local browser storage only.

Sign In

Sign in to sync your settings (dark mode preference and custom pivot services) across all your browsers and devices. Without an account, settings are saved in local browser storage only.

Tools

A separate toolbox, opened from Tools in the top navigation, for tasks that do not require a full URL check. Paste anything into the single box and it tells you what it found: a defanged IOC (refanged automatically, even across multiple lines), a hash, or Base64 (decoded to text, or to binary with a file-signature guess and a download link). Whatever you paste also gets encoded as Base64 and URI, hashed with MD5/SHA-1/SHA-256, and defanged if it looks like a URL. A separate drop zone decodes QR codes and extracts text from images with OCR. Everything runs in the browser; nothing here is sent anywhere.


Donations

Bitcoin: 3FqX4X3j6J8BcFKPnirG7L7LNUd4Xxu8Jn

Dogecoin: DRzthaf8RHSdocKsZZ9UxUWW9i277ap9ci

RawHTTPcoin: bG9sLiBqdXN0IGtpZGRpbmcu

Contact

contact[@]rawhttp[.]com

Tools

Everything runs in your browser, nothing is sent anywhere.

0 chars
Base64
URI encoded
MD5
SHA-1
SHA-256
Defanged
[ img ] Drop an image or click to upload — decodes QR codes • extracts text (OCR runs in your browser)