Free phishing simulation
for your own team.
Send a realistic fake phishing email to up to 25 of your employees and see, by name, who opens it, who clicks, and who types their password. Anyone who falls for it is shown what they missed in the same moment. Free forever, not a trial that runs out.
A real phishing test, not a demo
The free plan runs on the same engine as the paid ones. It's smaller, but it isn't a cut-down preview.
Four email attack styles
A tracked link to a realistic sign-in page, a QR code the victim scans with their own phone, a tracked attachment, and the "prove you're human, run this command" fake CAPTCHA known as ClickFix.
30+ ready-made lures
Templates with matching landing pages imitating Microsoft 365, Google, parcel delivery, e-signature and file-sharing notifications. Use one as it is, or clone it and make it look like your own company's mail.
Results by name, with timestamps
Every open, click and submitted form shows up in real time, per employee. Mail security scanners that follow links are recognised and left out, so the numbers show people, not filters.
Training at the moment of the click
Anyone who falls for it lands on an awareness page that points out the exact warning signs in the email they just trusted, in their own training language.
An employee portal
Employees can sign in and see their own history and score. You decide whether a leaderboard shows full names, initials only, or nothing.
Nothing to set up for sending
Simulations go out through Phishtime's managed mail, so there's no SMTP server to configure and your own sending domain's reputation is never involved.
Exactly what free means
No small print. Want to try the paid features before buying anything? Start the 30-day trial from inside your account, again without a card.
| Free, forever | 30-day trial | Paid plans | |
|---|---|---|---|
| Employees | 25 | 25 | up to 250, 1,000 or unlimited |
| Campaigns per 30 days | 1 | 10 | unlimited |
| Simulation emails per 30 days | 25 | 250 | 12 × seats, or unlimited |
| Link, QR, attachment and ClickFix lures | ✓ | ✓ | ✓ |
| Landing pages, tracking, awareness training | ✓ | ✓ | ✓ |
| Employee portal | ✓ | ✓ | ✓ |
| MFA push, OAuth consent and device-code lures | — | ✓ | ✓ |
| Your own sending domain, scheduling, API | — | ✓ | ✓ |
| How long results are kept | 6 months | 6 months | 12 months or more |
When the trial ends nothing is deleted. Your workspace goes back to the free plan, and the paid-only features come back the moment you pick a plan. Full plan comparison →
Your first simulation, today
Create an account
Your work email and a password. You're in your own workspace a minute later.
Prove the domain is yours
Add one DNS record. Campaigns can only ever reach addresses on domains your organisation has verified, so nobody can use Phishtime on people outside it.
Load up to 25 employees
Type them in or import a CSV. Start with yourself and a few colleagues who know a test is coming, if you'd rather watch it work first.
Pick a lure and launch
Choose a template, preview it, send yourself a test, then launch. Results start coming in as soon as the first email lands.
Built for teams that never had a phishing test
Small companies
Under 25 people, no security team, and a very real chance that one convincing email ends in a stolen mailbox or a paid fake invoice. The free plan covers you completely.
A pilot in a larger company
Run one campaign on a pilot group of 25 and walk into the budget meeting with your own click rate rather than an industry average.
IT partners and consultants
See the whole simulate, measure and train loop working on your own team before you recommend it to anyone else.
About the free plan
Is it really free, or a trial?
Really free. Hello World is a permanent plan, not a countdown. Up to 25 employees and one campaign every 30 days, for as long as you like. The separate 30-day trial is optional and falls back to the free plan when it ends.
Do I need a credit card?
No. Neither the free plan nor the trial asks for payment details. You only enter a card if you decide to buy a paid plan.
What happens if we have more than 25 employees?
The free plan holds up to 25 people. To reach everyone, pick a paid plan: you pay per employee, and the price per person falls as you add more. See pricing.
Do you see our employees' passwords?
No. When someone submits a simulated login form, Phishtime records that a field was filled and what the field was called. The value itself never reaches storage, on any plan.
Is running a phishing test on our employees legal?
Yes, when you run it on your own workforce, on domains your organisation has verified. Talk to HR or your works council before the first campaign; the docs include a pre-launch authorisation checklist.
Where is our data?
In the EU. The platform and its database are hosted in the European Union.
Find out who clicks.
One free campaign will tell you more about your real phishing risk than a whole year of e-learning completion certificates.