Wrapped URL decoder
Provider
Microsoft Safe Links
Steps
1
Final host
example.com
Clean URL
https://example.com/login
1. Microsoft Safe Links
local decodeExtracted url= redirect parameter.
https://example.com/login?utm_source=email
Wrapped URL decoded
1 wrapper removed without visiting the link.
A Safe Links decoder unwraps email security and redirect URLs to reveal the destination embedded inside the link. Paste a Microsoft Defender Safe Links URL, Proofpoint URL Defense link, Google redirect URL, or generic wrapped URL and the tool extracts the original target without visiting it.
Use it as an Outlook Safe Links decoder, Proofpoint URL Defense decoder, protected email link decoder, or wrapped redirect URL decoder when you need to understand where a suspicious or noisy link is pointing before opening it. The decoder runs in your browser, so the pasted URL is analyzed as text rather than fetched from the network.
| Use case | What to check |
|---|---|
| Phishing triage | Reveal the real host, scheme, query parameters, and warning signals. |
| Help desk tickets | Turn a long protected email link into a readable destination for review. |
| Incident response | Copy the unwrapped URL into a separate URL analysis workflow without clicking it. |
| Marketing link cleanup | Remove tracking parameters from benign redirect URLs before sharing them. |
| Wrapper | How it is decoded |
|---|---|
| Microsoft Safe Links | Extracts the embedded url parameter. |
| Proofpoint URL Defense | Decodes query-param and v3 path payload formats locally. |
| Google, Facebook, LinkedIn redirects | Reads common redirect params such as url, u, and q. |
| Generic wrapped URLs | Searches common params like target, redirect, and destination. |
Most wrapped URLs hide the target in a predictable place: a query parameter, a path payload, or a nested redirect URL. The examples below show the common shapes this tool looks for when decoding safe links and protected URLs.
| Pattern | Embedded target |
|---|---|
| https://*.safelinks.protection.outlook.com/?url=... | The percent-encoded value of url. |
| https://urldefense.proofpoint.com/v2/url?u=... | The Proofpoint-escaped value of u. |
| https://urldefense.proofpoint.com/v3/__...__ | The encoded path between double underscores. |
| https://www.google.com/url?q=... | The redirect destination in q or another known parameter. |
Many wrapped links are ordinary redirect URLs with a destination parameter. Spoold checks common names including url, u, q, target, destination, redirect, link, continue, next, and r.
The decoder also handles nested wrappers. For example, if a Microsoft Safe Links URL points to a Google redirect URL, the tool can remove both wrappers and show the final destination with the unwrap chain.
Microsoft Safe Links commonly rewrites email URLs through domains like safelinks.protection.outlook.com. The original destination is usually stored in the url query parameter, percent-encoded. This tool decodes that parameter and shows the clean destination. This is useful for searches like safelinks.protection.outlook.com decode, decode Safe Links URL, and Outlook protected link decoder.
Proofpoint URL Defense can wrap the target in a query parameter or in a v3 path section between double underscores. The decoder handles the common -3A hex escapes and underscore slash substitution used by Proofpoint-wrapped links.
Some email security products do not embed the original URL in the link. They store a short token that must be resolved by the vendor service. This tool will flag those links instead of visiting them, because the safe behavior is local decoding only.
After unwrapping, the tool can remove common tracking parameters such as utm_source, utm_campaign, fbclid, and gclid. The unstripped URL remains available when you need the exact original destination.
The decoder shows lightweight URL signals to help you decide what to inspect next. These are not malware verdicts; they are structural clues from the final URL.
| Signal | Meaning | Next check |
|---|---|---|
| Not HTTPS | The final destination uses an unencrypted or unexpected scheme. | Verify whether the sender should ever link to that scheme. |
| IP address destination | The URL points directly to an IP instead of a normal domain. | Check reputation and whether the IP matches the claimed brand. |
| Credentials in URL | The URL contains username or password data before the host. | Treat the display host carefully; credential syntax can mislead readers. |
| Punycode domain | The hostname contains encoded Unicode characters. | Look for brand impersonation or confusing lookalike characters. |
| Still looks wrapped | The final URL is still on a known redirect or protection domain. | Check whether the target is tokenized or needs vendor-side resolution. |
In those cases, a safe local decoder should say that the target is not embedded rather than clicking the link for you. Use a controlled security workflow or sandboxed URL analysis service when remote resolution is required.
No. It only decodes URL text in your browser. It does not send a request to the wrapped or final destination.
No. If the target URL is stored behind a vendor token rather than embedded in the link, local decoding cannot reveal it.
Yes. It recursively unwraps supported embedded redirects up to a small depth limit.
Some URLs contain multiple redirect layers or store the target behind a token. The tool removes locally visible layers and flags cases where the final target is still hidden.
The clean URL removes common tracking parameters. The unstripped URL keeps the exact decoded destination for investigations where every parameter matters.
No. It is a URL decoder and inspection helper. It reveals the destination and structural signals, but it does not classify the link as safe or malicious.
For a deeper breakdown of the final destination, open it in the URL Inspector.
