Safelink Decoder

This decoder shows where a wrapped link really goes. Paste a Microsoft SafeLink, a Proofpoint URL Defense link, a Google redirect or AMP address, or a Facebook link shim. It pulls out the original web address without visiting it.

Many email and security systems rewrite links so they can scan them when you click. Microsoft 365 turns https://example.com into a long address on safelinks.protection.outlook.com, with the real URL tucked inside and percent-encoded. That means characters like : and / are written as codes such as %3A and %2F. It is good for security but bad for reading. You cannot tell where a link leads, and the long form breaks when you paste it into a ticket or document.

Decoding happens in your browser using the text of the link alone, so no request goes to the wrapper or the final site. The tool unwraps up to 10 nested layers, such as a Google redirect around a SafeLink. It tells you which wrapper types it found and how many layers it removed. If it finds no wrapper, it says so and shows the link unchanged. Short links such as bit.ly work differently. The destination is stored on the short-link service, not in the link, so it cannot be shown without visiting it. Decoding a link does not make it safe, either. Check the domain carefully before you open it, especially in an unexpected email. To break the final address into its parts, use the URL Parser. To decode other percent-encoded text, try URL Encode and Decode.