Indicia

Safe Links & URL Defense decoder

Unwrap Microsoft Safe Links, Proofpoint URL Defense (v1, v2, v3), Barracuda and Google redirect links to the real address, without clicking them.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

    How it works

    Email security gateways rewrite every link in incoming mail so that they can check it when it is clicked. That protects users, but it makes the real destination unreadable when you are investigating a phishing report: the address you need is buried inside a long wrapper.

    Each wrapper hides the original address in its own way. Microsoft Safe Links URL-encodes it in the url parameter. Proofpoint URL Defense v2 swaps % for - and / for _. Version 3 keeps the address mostly readable but replaces some characters with * and stores them, Base64-encoded, after the address. This tool reverses each scheme exactly, so you get the address the sender wrote, without clicking.

    Paste one link or a whole list. Each is decoded as you type, and a link that is not wrapped, is cut off, or comes from a service that cannot be decoded offline is clearly marked rather than guessed at.

    Questions

    Is it safe to decode a link I think is malicious?
    Yes. The tool only reads the text of the link. It never visits, opens or prefetches the address, and the result is shown as plain text, not as a clickable link. Leave “Show results defanged” on and the result is safe to paste into a ticket or chat as well.
    Which link wrappers are supported?
    Microsoft Defender for Office 365 Safe Links (safelinks.protection.outlook.com), Proofpoint URL Defense versions 1, 2 and 3 (urldefense.proofpoint.com and urldefense.com), Barracuda Link Protection (linkprotect.cudasvc.com) and Google redirect links. A link wrapped more than once, for example Safe Links around a Proofpoint link, is unwrapped layer by layer, and each layer is listed.
    Why can't Mimecast links be decoded?
    Mimecast replaces the address with a short code and keeps the real address on its own servers, so there is nothing in the link itself to decode. Your email administrator can look it up in the Mimecast console.
    Is anything I paste sent to a server?
    No. Decoding runs entirely in your browser. The page’s security policy only allows it to talk to this website, it makes no requests while decoding, and nothing you paste is stored or logged.