How It Works
TinyRocket receives the link first.
Your browser opens it second.
macOS asks TinyRocket to handle links. When you choose to open one, TinyRocket hands it to your real browser. Safari, Chrome, Arc, whatever you use — nothing changes except that TinyRocket gets a look first.
Why this exists
The attack is a link.
A fake invoice. A package that needs a fee. A password reset you never asked for. Each can arrive as a link wearing a costume: the label says one thing, while the address says another.
The attack arrives as a link, so TinyRocket reads the link first — the disguise lives in the address, and the address can be checked before your browser follows it.
TinyRocket receives the link first
It receives the click from Mail, Messages, a PDF, a document — anywhere your Mac hands a link to a browser. It doesn’t render pages and doesn’t want to.
It reads the destination the way an attacker built it
Which domain actually answers, a brand name sitting where it shouldn’t, characters that aren’t what they seem, a shortener hiding the destination, a place already known for hosting attacks.
It gets out of the way
Recognized destination, nothing unusual: the link opens. No extra dialog or notification. When that happens, it should feel like nothing happened.
When something looks wrong, you decide
TinyRocket shows you what it found, in plain words, and waits. Stop, inspect, trust, or carry on. No tool can promise you’ll never reach a bad link — TinyRocket shortens the odds and shows its reasoning; common sense stays part of the system, and it stays yours.
The journey of one click, performed.
What TinyRocket can and can’t see
Reaches TinyRocket
- Links in Mail and Messages
- Notes, Preview and PDFs
- Office and iWork documents
- Calendar invitations
- Apps that hand a link to your default browser
Never reaches TinyRocket
- Links opened inside Slack’s built-in browser
- The same trick in Teams, Discord and others
Some apps let you turn their built-in browser off in settings. Until you do, links they keep inside the app do not reach TinyRocket.
We’d rather say it here, plainly, than have you find out later.
Features
Small, quiet, and honest about it.
The real destination, in plain text
Formatted text and buttons hide where a click goes by design. TinyRocket shows the registered domain before the page loads.
A threat database on your own disk
TinyRocket checks the list of known-bad domains before the destination page loads. The list is downloaded to your Mac and consulted there. Standard checks send us no link; Cloud Check sends only a public registrable domain when you ask.
Look-alike and shortener checks
A brand name in the wrong place, characters that aren’t what they seem, an address that hides its destination — each is flagged and explained, not silently scored.
Your trusted-domain list
During active checking, domains you trust can open straight through without a warning. The list is yours and is not uploaded.
Your browser stays your browser
When you choose to open a link, TinyRocket hands it to the browser you already use. You can change back at any time in System Settings.
No app account, no link tracking
Standard checks run on your Mac and send us no link. Cloud Check never sends a clicked URL; it sends only the public registrable domain when you ask. The full accounting is on the privacy page.
Cloud Check
Extra domain context, without opening the link.
A one-time link can hide a credential in any path, query, fragment or subdomain. A remote checker cannot prove an arbitrary full URL is safe to open. TinyRocket therefore keeps the full link on your Mac.
When you ask for Cloud Check, the app strips the link locally to its public registrable domain and sends only that domain with a short-lived day token. The service checks passive public registration data and reports how old the domain is. It does not contact the destination, follow redirects, or read page content.
It only ever runs when you ask it to
TinyRocket suggests it; it never does it on its own.
The full link never leaves your Mac
Subdomains, paths, queries, fragments and sign-in material are removed before the network request is created. If TinyRocket cannot derive one exact public registrable domain, nothing is sent.
Cloud Check is included throughout the free trial. It is not currently sold after the trial. See pricing.
Stop, inspect, or carry on — your call.
14-day free trial — no card, no account.