How to Check If a Website Is Safe Before Entering a Password

Before typing a password, credit card number, or any personal information into a website, it's worth taking ten seconds to check a few basic signals. None of these require special software — just knowing what to look for.

Check for HTTPS and the Padlock Icon

Look at your browser's address bar. A legitimate, secure site should show a small padlock icon and start with "https://" rather than "http://". This means the connection between your browser and the site is encrypted, so data you type can't easily be intercepted in transit.

Important caveat: HTTPS alone doesn't guarantee a site is trustworthy or legitimate — it only means the connection is encrypted. Scam sites can and do use HTTPS too. Treat it as a minimum requirement, not proof of safety.

Look Closely at the Domain Name

Scam sites often use domains designed to look almost identical to a real brand at a glance — swapping letters, adding extra words, or using a different top-level domain (like ".net" instead of ".com"). Read the domain character by character rather than skimming it. Watch for things like "paypa1.com" (a "1" instead of an "l"), "amazon-support.net", or a long string of extra words before the real domain name.

Be Cautious With Links From Email, SMS, or QR Codes

Rather than clicking a link sent to you, it's safer to open your browser and type the company's known website address directly, or use a bookmark you've saved previously. This avoids the most common trick attackers use — a link that looks correct in text but actually leads somewhere else entirely. If you do click through, immediately check the address bar before typing anything.

Watch for Urgency and Pressure Tactics

Legitimate companies rarely demand you act within minutes or threaten immediate account closure over email or text. Messages like "Your account will be suspended in 1 hour, click here now" are a classic pressure tactic designed to make you act before you think to verify anything. Slowing down is itself a form of protection — real companies give you reasonable time to respond.

Check Site Quality and Details

• Contact information — Legitimate businesses typically list a real address, support email, or phone number
• Spelling and design quality — Frequent typos, broken layouts, or low-quality images can be a red flag, though not definitive on their own
• Reviews outside the site itself — Search the company name plus "reviews" or "scam" separately, rather than trusting testimonials shown only on the site
• Payment methods — Be wary of sites that only accept unusual payment methods like gift cards or direct bank transfers for a purchase

If You've Already Entered a Password on a Suspicious Site

If you realize afterward that a site may not have been legitimate, change that password immediately — and change it on any other account where you reused the same password. This is exactly why using a unique, generated password for every account matters: it limits the damage from any single mistake to just one account instead of many.

Frequently Asked Questions

Does the padlock icon mean a site is definitely safe?

No. The padlock only confirms the connection is encrypted (HTTPS), not that the site itself is trustworthy. Scam sites can obtain HTTPS certificates too, so it's one signal among several, not a guarantee.

Is it safe to save my password in my browser?

Modern browser password managers use encryption and are generally considered reasonably safe for most people, especially compared to reusing weak passwords from memory. A dedicated password manager offers additional features but either approach is far better than no password manager at all.

What should I do if I'm still not sure a site is legitimate?

When in doubt, don't enter any information. Instead, navigate to the company's site independently (via search or a bookmark) or contact them directly through a verified channel to confirm the request is real.

Once you're on a legitimate site, make sure the account itself is protected with a strong password. See our guide: How to Generate Strong Passwords That Actually Protect You