No signup. No email harvest. Just answers. Built by ThouShaltNotClick — the phishing prevention platform trusted by schools and faith-based organizations across the country.
Free, print-ready “quishing” (QR phishing) awareness posters. Pick a tempting lure, add your org name, and download a full-page or 2-up half-page PDF. When staff scan it, they land on a friendly “gotcha” lesson.
Find out in seconds whether attackers can impersonate your domain in email. We check SPF, DMARC, and DKIM and give you a 0–100 risk score with plain-English fix suggestions.
Generate QR codes, and scan suspicious ones to reveal where they really go before you tap. Install it to your phone’s home screen for quick scan-and-check on the go.
Paste a suspicious link and see where it really goes. We peel off Safe Links, Proofpoint, Barracuda and other wrappers to reveal the true destination, then flag look-alike domains, IP-address hosts, and credential traps.
Paste a suspicious email’s raw headers for a plain-English verdict. We check SPF, DKIM, and DMARC alignment (did anything pass for the sender’s own domain?), the delivery path, and impersonation tricks like a name that hides a different address.
Drop in a photo or screenshot to see what it quietly reveals — the camera or software that made it, GPS coordinates of where it was taken, editing history, and any AI-generation or Content-Credentials markers. Download a metadata-free copy before you share.
Black out student names, faces, or IDs before you share a screenshot. Unlike a box drawn in Preview or Word, the blacked-out pixels are permanently destroyed in the download — not just covered — and all hidden metadata (including GPS) is stripped.
Paste your class roster and get a printable cut-out card for each student with a memorable, strong passphrase (like tiny-frog-cloud19). Words are drawn from a kid-safe list using your device’s secure random generator. Perfect for first-login day.
Check whether your domain’s SPF record actually protects you — and if it’s over the hidden “10 DNS lookup” limit that silently breaks it. Then build one clean, correctly-ordered record from a checklist of the senders you use, so you never hand-edit an SPF string again.
Build a correct DMARC record with safe defaults and a step-by-step ramp (monitor → quarantine → reject) so you finally see who sends as your domain — without accidentally blocking your own mail. Look up your current record and get plain-English fixes.
AI-powered phishing simulations, automated training, dark-web monitoring, community-driven threat detection, and faith-aware scenarios (Catholic, Christian, Jewish, Muslim, non-denominational, secular). Whole-school protection from $5/staff/month.
See plans →