Proofpoint URL decoder for urldefense v1, v2 and v3 links.
Paste urldefense.com/v3/__… or urldefense.proofpoint.com/v2/url?u=… links and get the original addresses back — one or hundreds at a time. Uses the same algorithm as Proofpoint’s own decoder, and nothing leaves your browser.
Decoding happens in your browser — links are never uploaded. Destinations are shown as text, not clickable links, so you can't open one by accident.
The three URL Defense formats
Proofpoint has changed how it rewrites links twice, so you’ll meet all three versions in older and newer mail. The decoder detects the version from the link itself.
- v1 —
https://urldefense.proofpoint.com/v1/url?u=<address>&k=…. The address sits inu=, percent-encoded as usual. - v2 —
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.example.com_page&d=…. The address is percent-encoded and then two characters are swapped so it survives mail systems: every%becomes-and every/becomes_. So-3Ais:and__is//. - v3 —
https://urldefense.com/v3/__https://www.example.com/page*ref*email__;Pz0!!…$. The address is mostly readable, but characters Proofpoint wants to protect are replaced with*(one character) or**plus a letter (a run of characters). The text between;and!!is those removed characters, Base64url-encoded. The decoder puts them back in order.
A v3 link, decoded by hand
Proofpoint’s own documentation example is https://urldefense.com/v3/__https://google.com:443/search?q=a*test&gs=ps__;Kw!. The part after ; is Kw, which is Base64 for +. The single * is replaced by that +, giving https://google.com:443/search?q=a+test&gs=ps — exactly what this page returns.
When a v3 link won’t decode
The usual cause is a link that was cut short — copied from a preview, wrapped across lines in a plain-text email, or missing the part after ;. Without the replacement characters the * placeholders can’t be filled in, so the decoder says so rather than returning a wrong address. Copy the full link from the email’s source (in Outlook: View source; in Gmail: Show original) and try again.
Sources & how each format is handled
- Proofpoint URL Defense v1, v2, v3. Decoded with the same algorithm as Proofpoint’s own published decoder (
urldecoder.pyv3.0.1, from Proofpoint’s help centre). We tested this page against that script on 402 links, including every sample in Proofpoint’s URL Decoder API documentation, and the output matched on all of them. help.proofpoint.com - Microsoft Defender Safe Links. Microsoft documents that links are rewritten to
https://<region>.safelinks.protection.outlook.com. The original address travels in theurl=parameter of that link; Microsoft doesn’t publish the parameter layout, so that part is based on real Safe Links. learn.microsoft.com - Barracuda, Cisco Secure Email, Google, Facebook, LinkedIn, Slack. None of these vendors publishes its rewrite format. The rules here come from real rewritten links: Barracuda’s
a=parameter, Cisco’s encoded last path segment, Google’sq=, Facebook’su=, LinkedIn’s and Slack’surl=. - Mimecast. Mimecast swaps the address for a token and keeps the real destination on its servers, so it can’t be decoded from the link. The tool tells you that instead of guessing.
Honest scope: decoding shows you where a link goes. It doesn’t tell you whether that destination is safe — that’s what the warnings and the optional VirusTotal check are for. If a vendor changes its format, tell us via the contact page and we’ll update the decoder.
Common questions.
Paste it above. The decoder recognises v1, v2 and v3 links automatically and returns the original address, using the same algorithm as Proofpoint’s published urldecoder.py.
They are placeholders. A single * stands for one character and ** plus a letter stands for a run of characters; the removed characters are stored Base64url-encoded after the ;. The decoder restores them in order.
In v2 links every % of normal percent-encoding is written as - and every / as _. So -3A is %3A (a colon) and __ is //.
It follows the same algorithm. We ran this page and Proofpoint’s urldecoder.py (v3.0.1) on the same 402 links, including the examples in Proofpoint’s URL Decoder API documentation, and the results matched on every one.
No. Proofpoint’s own URL Decoder lives in the TAP dashboard and needs a login; this page needs nothing and runs in your browser.
Yes. It keeps unwrapping until it reaches the real address, and shows each wrapper (Safe Links, then Proofpoint, and so on) in order.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Everything on this page runs in your browser; nothing you paste is uploaded or logged.