SafeLinks decoder: see where an email link really goes.
Paste a Microsoft Safe Links URL — or a whole email — and get the original address back. Also unwraps Proofpoint, Barracuda, Cisco and redirect links, flags phishing tricks, and never uploads anything.
Decoding happens in your browser — links are never uploaded. Destinations are shown as text, not clickable links, so you can't open one by accident.
What a Safe Links URL is
When your organisation uses Microsoft Defender for Office 365, every link in incoming mail is rewritten so it points at Microsoft first: https://nam12.safelinks.protection.outlook.com/?url=…&data=…&sdata=…&reserved=0. When you click, Microsoft checks the destination and then forwards you on. The real address is still inside, percent-encoded in the url= parameter — this tool pulls it out and decodes it.
The other parameters are Microsoft’s: data= carries tenant and message details, sdata= is a signature, and reserved=0 is fixed. None of them is needed to know where the link goes.
Why decode instead of clicking
- Check before you click. Hovering in Outlook only shows the wrapper. Decoding shows the actual domain, so a look-alike like
micros0ft-support.comstands out. - Share a clean link. Safe Links URLs are long, tied to your tenant, and break when pasted into a ticket, a chat or a document. The decoded link works for anyone.
- Investigate a report. Security teams can paste a whole suspicious email and get every destination at once, with a CSV for the incident record.
Links wrapped more than once
Mail that passes through two organisations often gets wrapped twice — a Proofpoint link inside a Safe Link, for example. The decoder keeps peeling until it reaches the real address, and shows each wrapper in order so you can see the path the message took.
The warnings explained
- User name before “@” — in
https://paypal.com@evil.example/the browser ignores everything before the@. The real host isevil.example. - Punycode (
xn--) domain — internationalised domains can use letters that look identical to Latin ones. Worth a second look when the name resembles a brand. - Bare IP address, plain
http://, unusual port,javascript:ordata:schemes — not proof of anything, but rare in legitimate business mail.
Sources & how each format is handled
- Proofpoint URL Defense v1, v2, v3. Decoded with the same algorithm as Proofpoint’s own published decoder (
urldecoder.pyv3.0.1, from Proofpoint’s help centre). We tested this page against that script on 402 links, including every sample in Proofpoint’s URL Decoder API documentation, and the output matched on all of them. help.proofpoint.com - Microsoft Defender Safe Links. Microsoft documents that links are rewritten to
https://<region>.safelinks.protection.outlook.com. The original address travels in theurl=parameter of that link; Microsoft doesn’t publish the parameter layout, so that part is based on real Safe Links. learn.microsoft.com - Barracuda, Cisco Secure Email, Google, Facebook, LinkedIn, Slack. None of these vendors publishes its rewrite format. The rules here come from real rewritten links: Barracuda’s
a=parameter, Cisco’s encoded last path segment, Google’sq=, Facebook’su=, LinkedIn’s and Slack’surl=. - Mimecast. Mimecast swaps the address for a token and keeps the real destination on its servers, so it can’t be decoded from the link. The tool tells you that instead of guessing.
Honest scope: decoding shows you where a link goes. It doesn’t tell you whether that destination is safe — that’s what the warnings and the optional VirusTotal check are for. If a vendor changes its format, tell us via the contact page and we’ll update the decoder.
Common questions.
Paste it into the box above. The original address is percent-encoded in the url= parameter; the tool extracts it and decodes it, and shows any phishing warnings for the destination.
Yes. Decoding happens entirely in your browser — nothing is uploaded, logged or fetched. Destinations are shown as plain text rather than clickable links, so you can’t open one by mistake. The VirusTotal button only sends a link to VirusTotal if you click it.
Yes. Paste one link per line, or paste a whole email (plain text or HTML source) and every link is found automatically — up to 500 at a time. Use “Download CSV” to keep a record.
Decoding doesn’t click anything. But if you then open the decoded address directly, Microsoft doesn’t get the chance to check it at click time. Use the decoded link to inspect where it goes; open it only if you trust the destination.
Mimecast replaces the address with a token and stores the real destination on its own servers, so the destination isn’t in the link at all. Only Mimecast (or your IT team, through Mimecast’s admin tools) can look it up.
Proofpoint URL Defense (v1, v2 and v3), Barracuda Link Protection, Cisco Secure Email, Google and Facebook redirects, LinkedIn and Slack redirect links, generic ?url= / ?redirect= parameters, plus percent-encoded and Base64-encoded URLs.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Everything on this page runs in your browser; nothing you paste is uploaded or logged.