Safelink Decoder
WebFree online safelink decoder — decode Outlook / Office365 safelink URLs back to their original URLs in batch. Strip tracking wrappers and recover real links from email safely. Runs locally, no upload, no signup.
About Safelink Decoder
For safety, many mail, IM, and office systems rewrite original links into "safe links", wrapping the real address inside Microsoft Safe Links, Outlook, or Proofpoint URLDefense wrappers, hiding the final destination. This tool recognizes these common wrapper formats locally in your browser, extracts and percent-decodes the nested original URL, and lets you see where a link truly goes before clicking, helping spot phishing. The whole unwrapping runs in your browser, and the link to decode is never sent to any remote server. Tip: Bookmark this tool for quick access during your web development work. All processing happens locally in your browser with no installation required.
How to Use
- Open the Safelink Decoder tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- Spot phishing — Reveal a wrapped link's real domain before clicking to judge if it is malicious.
- Clean mail links — Restore Safe Links-rewritten URLs in email back to clean, shareable originals.
- Trace redirects — Unwrap multi-layer safe wrappers to find the final landing page for debugging.
- Security audit — Batch-restore protected links logged in records to analyze real visit targets.
- Copy original link — Extract the clean URL from a long protective wrapper for archiving or citation.
- Phishing analysis — Unwrap a link in a suspicious email to see the real destination before deciding whether to report it.
- Email automation — Restore clean URLs from Safe Links in automated email parsing pipelines to get the original target.
FAQ
Which safe-link formats are supported?
Common ones include Microsoft Defender Safe Links (safelinks.protection.outlook.com) and Proofpoint URLDefense (urldefense.com v2 and v3). The tool recognizes their parameter structure and extracts the inner real URL.
Is a decoded link automatically safe?
No. Decoding only lets you see the real address; you still must judge whether the target domain is trustworthy. Do not visit unfamiliar or spoofed domains.
Why does URLDefense v3 decode differently?
v3 is not plain percent-encoding but uses custom substitutions for special characters (compressing certain symbols), requiring reversal by its own rules, which this tool has built in.
What if the link is wrapped multiple times?
Sometimes several gateways rewrite a link in sequence. Paste the first decode result back in to peel each layer until you reach a final address with no wrapper traces.
How does it differ from a generic URL decoder?
A generic decoder only does universal percent-decoding, while this tool understands each protection product's proprietary wrapping rules and pinpoints the nested original URL. For pure percent-decoding, use our URL parser tool.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.