SafeLink Decoder

What is a SafeLink?

Email security gateways rewrite the links inside your messages so every click is checked against a threat-scanning service first. Microsoft calls this feature SafeLinks (part of Defender for Office 365); Proofpoint calls it URL Defense. The rewritten link points at the vendor's host — something like nam02.safelinks.protection.outlook.com or urldefense.proofpoint.com — and tucks the real destination away inside a query parameter. That's great for security, but it makes links impossible to read at a glance and awkward to copy, share, or archive.

SafeLink Decoder unwraps those links back to their original URL. It does the work entirely in your browser with plain string and URL parsing — no request is ever made to the wrapped link or to any server, so nothing you paste leaves your machine.

How to use it

1. Paste one or more wrapped links into the input box — one per line.
2. The decoded destination for each line appears instantly on the right.
3. Lines that aren't wrapped links (plain notes, already-clean URLs) pass through unchanged, so you can drop in a whole snippet of pasted text.
4. Tick Show only decoded URLs to hide every non-decoded line and keep just the extracted destinations — handy for building a clean list.

Use the Copy or Download button to grab the result as decoded-urls.txt.

Which link wrappers are supported?

• Microsoft SafeLinks — any *.safelinks.protection.outlook.com link. The original URL is read from the url parameter.
• Proofpoint URL Defense v1 and v2 — urldefense.proofpoint.com links whose destination is stored in the u parameter (v2 additionally swaps -/_ for %// before decoding).
• Proofpoint URL Defense v3 — urldefense.com/v3/ links are decoded when the destination is stored verbatim. A minority of v3 links encode special characters as "runes" (marked with *); those are left unchanged rather than risk producing a wrong URL.

Why isn't Mimecast supported?

Mimecast's protect-*.mimecast.com links don't carry the full destination in a recoverable form — the link only references a server-side token plus, at most, the target domain — so the original URL generally can't be reconstructed from the link text alone. Rather than return a partial or misleading result, those links are passed through unchanged.

Is it safe to paste corporate links here?

Yes. Decoding is pure text parsing that runs client-side; the tool never opens the link or contacts the destination. Note that a SafeLink's data parameter can contain an encoded copy of the original recipient's email address — that metadata is simply ignored, and only the destination URL is extracted.