What to check in the URL before you type a private key or seed phrase anywhere

05 September 2026

You must check that the URL is exactly correct. The moment you type a private key or seed phrase into a site that is not the real one, your funds can be taken instantly and permanently.

Phishing sites trick people by using URLs that look almost right. They register domain names with typos, extra characters, or unfamiliar top-level extensions. A site might be whitecoffeecat.lol and the fake might be wh1tecoffeecat.lol or white-coffee-cat.lol. The difference is a single character you can miss in a glance.

The most reliable check is to type the URL yourself from a known source. Do not click a link from an email, a social media post, or a chat message. If you must use a link, hover over it before clicking. Look at the status bar or the tooltip that appears. Does the displayed URL match the link text? Many phishing links display one thing and point to another.

Check the domain name carefully, character by character. Pay attention to:

• Substitutions that look similar: 0 for O, 1 for l, rn for m.
• Extra words or dashes inserted into the domain. For example, whitecoffeecat-login.lol is not the same as whitecoffeecat.lol.
• The top-level domain. If the real site uses .lol but you see .com, .net, or something else, treat it as suspicious.
• The protocol. The URL should start with https://. A site that asks for a private key over http:// is dangerous, though https:// alone does not guarantee safety.

Check the full URL, not just the domain name. Some phishing sites put a legitimate domain in the path portion after the main domain, like whitecoffeecat.lol.evilsite.com. The part before the first single slash after the protocol is the actual domain. Everything after that is a path on that domain, not a separate site.

Look for a padlock icon in the address bar. Its presence means the connection is encrypted. Its absence means any data you send can be read by others. But the padlock does not mean the site itself is trustworthy. A phishing site can have a valid SSL certificate too.

Before typing a private key or seed phrase, pause. Ask yourself why a site would need that information at all. A legitimate swap site does not need your seed phrase or private key. It only needs a receiving address. If the site asks for your private key or seed phrase, it is a scam. Close the tab.

If you are unsure, open a new browser tab and type the known URL manually. Compare the site appearance. Phishing sites often copy the design exactly, but sometimes the fonts, images, or layout are slightly off. Do not rely on appearance alone. Use a bookmark you created yourself from the trusted source.

After verifying the URL, the next step is to test the swap address with a tiny amount. That subject is covered on the sibling page under "Swapping crypto safely". The small test confirms the destination is correct before you commit a larger amount.

A single wrong character in a URL can empty a wallet in seconds. Check it slowly. Check it twice. If anything feels off, stop. The cost of being sure is a few seconds. The cost of being wrong is everything in that wallet.

Back to exchange fees