Networking & Web

Safelink URL Decoder

Paste a wrapped Safelinks or URLDefense link to instantly see the original URL underneath, without having to click it.

Free & unlimitedRuns in your browserNo sign-up required

Safelink or Encoded URL

Detected Provider: Microsoft Defender (Safelinks)

Decoded Target URL

https://twoworks.co/tools

Open Link Safely (New Tab)

Enterprise Safelinks Explained

Enterprise email systems wrap incoming URLs with tracking and security proxy links to protect users from phishing and malware. The two most common providers are Microsoft Defender (Safelinks) and Proofpoint (URL Defense).

How Safelinks work

When an email arrives, the security gateway rewrites every hyperlink. When a user clicks the link, they are taken to the security provider's server first. The provider checks the original URL against a real-time blacklist. If safe, the user is redirected; if malicious, they are blocked.

Why decode them manually?

Security analysts, IT administrators, and cautious users often need to know the actual destination of a link before clicking it. By decoding the Safelink wrapper, you can inspect the original domain, perform your own threat intelligence checks (e.g., VirusTotal), or extract the raw URL for documentation.

URL encoding mechanisms

Microsoft Safelinks uses standard URL encoding (percent-encoding) in the `url=` parameter. Proofpoint v2 uses a proprietary substitution method where dashes replace percent signs, and underscores replace slashes. This tool automatically detects and reverses both encoding schemes.

Loading tool…

How it works

Three steps, no setup

Paste the wrapped link

Copy the full URL from the suspicious or forwarded email.

Decode it instantly

The original destination URL is extracted from the wrapper parameters.

Review before visiting

Check the real domain before deciding whether to open it.

Common questions

Frequently asked questions

Why do emails wrap links like this?

Enterprise email security services like Microsoft Defender and Proofpoint rewrite links to scan the destination for threats each time they are clicked.

Does decoding a link visit it?

No, this only parses the URL structure to extract the embedded destination — it does not make a request to either link.

Keep exploring

Related tools

View all tools

Networking & Web

Safelink URL Decoder

Enterprise Safelinks Explained

How Safelinks work

Why decode them manually?

URL encoding mechanisms

Three steps, no setup

Paste the wrapped link

Decode it instantly

Review before visiting

Frequently asked questions

Related tools

IPv4 Subnet Calculator

IPv4 Address Converter

IPv4 Range Expander

IPv6 ULA Generator

MAC Address Vendor Lookup

Random MAC Address Generator

twoworks

Enterprise Safelinks Explained

How Safelinks work

Why decode them manually?

URL encoding mechanisms