100% freeNo sign-upsNo trackingKeeps working with the internet off
A web page says “verify you are human” or “fix this error”, then asks you to press keys, open Run or Terminal, and paste something. Check it here first.
The short answer. Never paste a command from a web page into your computer. A real “verify you are human” check only needs a tick or a tap on pictures. If a page asks you to open Run, PowerShell or Terminal, or to press Control and V, close the page. This tool reads the writing or command you give it and points out the common warning signs. It runs on your own device and never runs what you paste.
How it works, in four steps
Paste or choosePaste the command a web page asked you to run.
The check runs on your own phone or computerWhat you add stays on your device, and the page keeps working with the internet off.
Read what it found and what to do nextSee the signs of a fake “verify you are human” trick and what to do next.
What this check cannot doIt looks for common signs only, so it cannot tell you a command is safe.
What you type here stays on this phone or computer. There is no sign-up, and nothing is saved. Turn the internet off and this page still works.
Stop. Close the page.
If you have not pressed Enter, nothing has run, and closing the page stops it here. If you already pressed Enter, choose the third button on the first screen.
A real “verify you are human” check only needs a tick, a tap on pictures or a short puzzle inside the page. It never needs the Windows key, Control and V, Run, PowerShell or Terminal.
Pressing Control and V pastes a command the page has quietly placed in your copy-and-paste memory (the clipboard), and pressing Enter runs it on your own computer.
If the page keeps coming back, close the tab, then open the website again by typing its address yourself.
If you were told to do this at work, tell your information technology team and show them the page.
Not sure what you were asked to do?
Copy the writing from the page, or the command, and check it. It is read on this device only.
If you cannot close it
If the page fills the screen, press Alt and F4 on Windows, or Command and Q on a Mac, or restart the computer. Nothing is run until you press Enter in a window you opened.
Check it.
Paste the command, or the writing from the page that tells you what to do. It is only read as text. It is never run.
The one rule
Never paste a command from a web page. If a page, a message or a caller tells you to open Run, PowerShell or Terminal and paste, close it and tell someone you trust.
If you already ran it.
It is worth acting now, and it is not your fault. These fake checks are built to look real. These steps help.
Disconnect that device from the internet: switch off the wifi or unplug the cable. Leave it switched on.
From a different phone or computer, change the passwords for your email first, then your bank and anything else important. Do not type them on the affected device.
Phone your bank on the number on the back of your card if you use banking or card details on that device, and tell them what happened.
If it is a work device or the page was about work, tell your information technology team straight away.
Run a full scan with your security software, or take the device to someone qualified to clean it. Resetting the device is the most thorough way to remove what was installed.
Write down the page address, the time and what you pasted if you remember, so you can report it.
The tool says: Stop. Do not run it. It finds seven warning signs: it tells you to open the Run box, it uses the words of a human check, a real human check only needs a tick or a tap, it uses PowerShell, it tries to run hidden, it downloads something and runs it, and it holds a web address inside the command.
What to do: close the page without pasting anything. A real human check never asks you to paste a command. If it has already been run, follow the steps in the tool under “If you already ran it”. “No common warning signs found” would never mean a command is safe.
Questions people ask
Who made this?
UtilForge makes it. UtilForge is a website of free cybersecurity tools. The About page explains why the tools were made, and the Contact page is the way to reach us.
What is a fake verify you are human check?
It looks like the tick box that proves you are not a robot. Then it asks you to press the Windows key and R, press Control and V, and press Enter, or to open Terminal and paste something. A real check never asks for that. The paste is a command that runs on your own computer. This technique is sometimes called ClickFix, a name security researchers use.
What is the one rule?
Never paste a command from a web page into your computer. A real check only needs a tick or a tap on pictures.
What if I already ran it?
Choose the third button on this page for the steps to take now. The sooner they are taken, the better.
Does this page send what I paste anywhere?
No. It is set so that your browser stops the page sending anything off your phone or computer, and you can test that: let the page finish loading, switch the internet off and use it. It never runs what you paste, it only reads it as text.
Tell UtilForge what worked and what did not. Each button opens an email to lindsay@utilforge.org that you write and send yourself. UtilForge will only quote your words on this site if you say it may, and then with your first name and country only.
The whole method in one book. “How to Become Safer Online” is a free large-print guide to the five steps most scams follow, and what to do if money or details have already gone. Read or print the free book.