URL X-ray: unwrap every layer of a link.
Paste any link. The X-ray peels off wrappers, redirects, double encoding and Base64 one layer at a time, shows the real destination, explains each parameter — trackers, nested URLs, JWTs — and gives you a clean link.
What the X-ray looks for
Links you meet in the wild are rarely just an address. They pass through mail filters, ad networks and analytics, and each one adds a layer. The X-ray removes them in order, and stops when nothing more can be peeled.
- Email-security wrappers — Microsoft Safe Links, Proofpoint URL Defense (v1, v2, v3), Barracuda, Cisco Secure Email. Mimecast tokens are recognised but can’t be decoded (the destination isn’t in the link).
- Redirects — Google, Facebook, LinkedIn and Slack redirect links, and any parameter like
url=,redirect=,next=ordest=whose value is a full URL. - Encoding — a whole URL that was percent-encoded (
https%3A%2F%2F…), double encoding (%2520), and URLs hidden in Base64.
Reading the parameters
Once it reaches the real destination, the X-ray lists every query parameter, decoded, and says what it is:
- Tracking —
utm_*campaign tags and click IDs such asgclid(Google Ads),fbclid(Facebook),msclkid(Microsoft Ads) andmc_eid(Mailchimp). The clean link removes only these and keeps everything the page may need. - Nested URLs — one click X-rays the inner link too.
- JWTs — tokens starting
eyJare decoded so you can read the header and claims, withexp/iatturned into dates. The signature is not verified. - Base64, still-encoded values and email addresses — so you can spot personal data or double encoding.
A JWT or email address in a link is worth noticing: anyone you forward the link to can read it too.
Sources & standards
- RFC 3986 — URI Generic Syntax: percent-encoding (§2.1) and URL components (§3). rfc-editor.org/rfc/rfc3986
- RFC 4648 — Base64 and Base64url (§4, §5). rfc-editor.org/rfc/rfc4648
- RFC 7519 — JSON Web Token: structure and the
exp,iat,nbfclaims (§4.1). rfc-editor.org/rfc/rfc7519 - Proofpoint URL Defense follows Proofpoint’s published decoder; other wrapper formats are explained on the SafeLinks decoder page.
Common questions.
A tool that takes a link apart layer by layer: it removes email-security wrappers, redirects and extra encoding until it reaches the real destination, then explains every part of that destination.
A decoder undoes one layer of percent-encoding. The X-ray recognises wrappers and redirects, repeats until nothing is left to remove, and then inspects the result — trackers, nested links, tokens and warning signs.
No. Everything happens in your browser by reading the text of the link. Nothing is fetched, so it’s safe for suspicious links. Shortened links (bit.ly and similar) can’t be expanded this way, because the destination is stored on the shortener’s server — use the URL expander for those.
Only known tracking parameters: utm_* tags and click IDs such as gclid, fbclid, msclkid, mc_eid and HubSpot or Marketo tokens. Other parameters stay, because the page may need them to work.
No — checking it needs the issuer’s secret or public key. The X-ray only decodes the header and payload so you can read them.
More from the toolkit.
About this page. Written and maintained by Sri Murugan Systems, the developer of urlencodedecode.com. Everything on this page runs in your browser; nothing you paste is uploaded or logged.