Privacy

What happens to a phone number you type into this site, described precisely rather than reassuringly.

At a glance

Phone numbers entered on this site are never written to storage in readable form. When a live lookup runs, the number is converted to a salted HMAC hash and only that hash is kept, as a cache key, for 24 hours. There is no account system, no bulk mode, no public API, and no sale or sharing of check data.

What happens to a number I check?

In link-first mode, nothing leaves your browser. The number is validated and formatted on your device, the wa.me link is built there, and no request carrying the number is sent to this site at all.

When a live lookup runs, the number is sent to this site's server over HTTPS, converted immediately to a salted HMAC-SHA256 hash, and used to query WhatsApp. The raw number is held only in memory for the duration of that request and is never written to a database, a log file or an analytics event.

What is stored, and for how long?

Only the hash, and only for 24 hours.

The hash is the key of a cache entry whose value is the result of the check. Its purpose is to avoid asking WhatsApp the same question twice in a day, which is both faster for you and gentler on WhatsApp. After 24 hours the entry expires and is deleted.

  • Hashing: HMAC-SHA256 with a server-side secret salt. The salt never leaves the server, and without it the hash cannot be linked back to a number.
  • Reversibility: The hash cannot be reversed to recover the number. Because phone numbers come from a small, enumerable space, a plain unsalted hash would be trivially breakable by brute force. The secret salt is what prevents that, and it is the reason the salt is treated as a credential.
  • What the cache value contains: The registration result only. No number, no country, no identifier for you.

What is logged?

Operational logs record that a check happened, whether it succeeded, and errors. Phone numbers are redacted from log output before it is written.

Standard hosting logs kept by Vercel record request metadata such as IP address and user agent, as they do for any site. Those are subject to Vercel's own retention.

Why is there no bulk checking or public API?

Because the main commercial use for both is building lists for unsolicited messaging, and that is a use this tool refuses to serve.

This is the single largest design decision on the site. A number checker with a bulk mode is a lead-generation tool for spam campaigns, whatever it calls itself. There is no CSV upload, no batch endpoint, no API key, and no paid tier that unlocks one. This is not a limitation waiting to be lifted.

Checking large volumes of numbers also breaks WhatsApp's terms of service and is a well-known way to get a WhatsApp account permanently banned. The tools that offer it are putting their users' accounts at risk as well as other people's inboxes.

How is abuse prevented?

Two mechanisms, both of which apply to everyone.

  • Rate limiting: Checks are capped per visitor over a rolling window. Hitting the cap returns a wait time rather than a result.
  • Bot protection: The check endpoint runs behind Vercel BotID, which blocks automated clients. This is what stops the tool being wrapped in a script and used as the bulk checker it declines to be.

Are there cookies or trackers?

There are no cookies at all, no advertising trackers and no cross-site identifiers.

There is aggregate analytics. Vercel Analytics counts page views so it is possible to see which pages are used. It is cookieless, it does not assign you an identifier that persists across sites, and it never receives anything you type. A phone number you enter is never part of an analytics event.

Fonts are served from this site's own origin, so no request goes to a font provider while you use the site.

Does the person I check find out?

No. Neither a live lookup nor opening a chat link notifies the other person or leaves any trace on their device.

They learn of you only if you send a message.

Frequently asked questions

Do you store the phone numbers I check?

No. Numbers are never written to storage in readable form. When a live lookup runs, the number is converted to a salted HMAC-SHA256 hash and only that hash is retained, as a cache key, for 24 hours.

Can the stored hash be turned back into a phone number?

No. The hash is salted with a server-side secret that never leaves the server. Without the salt the hash cannot be linked back to a number, which matters because phone numbers are otherwise a small enough space to brute-force.

Does this site sell or share the numbers checked?

No. There is nothing to sell, because raw numbers are never retained, and check data is not shared with anyone.

Why is there no bulk checking?

Because bulk checking is used almost entirely to build lists for unsolicited messaging. It also breaks WhatsApp's terms and is a common cause of permanent account bans. There is no CSV upload, no batch endpoint and no paid tier that adds one.

Does the person I look up get notified?

No. Neither a lookup nor opening a chat link sends a notification or leaves any trace for the other person. They only learn of you if you send a message.

Do you use tracking cookies?

No. The site sets no cookies at all and uses no advertising trackers or cross-site identifiers. There is cookieless aggregate analytics (Vercel Analytics) which counts page views and never receives anything you type.