Safe Links & URL Defense Decoder
Unwrap Microsoft Safe Links, Proofpoint URL Defense v1/v2/v3 and Barracuda links locally. Inspect nested destinations without opening them.
Inspect the destination without visiting it
Paste the full rewritten URL, including its query string. The report shows the final extracted URL and each wrapper in order. Recursive mode handles up to ten supported layers. An ordinary HTTP or HTTPS URL is returned unchanged with decoded=false.
Recognized hosts are Microsoft safelinks.protection.outlook.com and its subdomains; Proofpoint urldefense.proofpoint.com, urldefense.com and urldefense.us; and Barracuda linkprotect.cudasvc.com. Similar-looking unrelated hostnames are not trusted as these providers. The destination is plain text, not an automatically opened link.
What decoding can and cannot show
Microsoft and Barracuda links contain a destination parameter. Proofpoint v1/v2 use a u parameter, with v2 character substitutions; v3 uses an embedded URL and a base64url replacement stream, including multi-byte runs. The decoder extracts only data actually present in the copied link.
Truncated URLs, missing or duplicate destination parameters, malformed encodings and destinations outside HTTP/HTTPS are rejected. Up to 20,000 input characters are accepted. This does not contact the gateway, verify its signature, scan the target, bypass a block or prove a URL is safe. Decoding preserves percent escapes belonging to the original destination instead of repeatedly decoding them into different URL semantics.
Reference
Questions & answers
Why does the result still contain %20 or %2F?
Those escapes may belong to the original URL rather than the wrapper. Decoding them again could change a path, query or delimiter.
Can this recover a server-only destination?
No. It can only decode supported data embedded in the link itself. A gateway account or vendor API may be required for other formats.
Is my input uploaded?
No. Parsing and generation run in your browser. Engines and datasets load from this site; the tool does not store input or send it to a processing API.