SafeLink Decoder
Paste a rewritten link and reveal its real destination — SafeLinks, Proofpoint, Google and generic redirectors, unwrapped (and un-nested) in your browser.
SafeLink decoder
Corporate mail systems rewrite links so they point at a scanner first. Paste one of those rewritten links and get the real destination back. It all happens in your browser — the link is decoded from the text, never fetched.
Wrappers it unwraps
- Outlook SafeLinks —
*.safelinks.protection.outlook.com/?url=… - Proofpoint URLDefense — both
v2(?u=…with-/_encoding) andv3(/v3/__…__;…) - Google redirects —
google.com/url?q=… - Generic redirectors — any link with a
url=,q=,u=,target=,redirect=, … parameter pointing at anhttp(s)URL
Nested wrappers (a SafeLink wrapping a Google redirect, …) are followed automatically.
Why it's safe
It only decodes the text you paste — it never opens or fetches the link, so you can inspect a suspicious destination without visiting it.
FAQ
Does it visit the link?
No. It's pure local string decoding; nothing is fetched or uploaded.
My link wasn't a known wrapper.
It's returned unchanged — only recognized wrappers are unwrapped.
How many layers of nesting does it follow?
Up to 8. Each pass unwraps one layer (say a SafeLink whose target is a Google redirect whose target is the real page) and stops as soon as the result is no longer a recognized wrapper — so even multiply-forwarded corporate mail links resolve in one click.
How are the two Proofpoint URLDefense versions handled?
v2 links carry the destination in a ?u= parameter with a substitution
cipher — - stands for % and _ for / — which is reversed before
percent-decoding. v3 links embed the URL literally between /v3/__ and
__; (followed by an encoded checksum), so it's extracted from there. Both are
detected automatically from the link shape.
Can I decode a whole list of links at once?
Yes — paste one link per line and enable Unwrap each line separately (batch). Every non-empty line is decoded independently and blank lines are preserved, so the output lines up 1:1 with your input for pasting back into a spreadsheet or report.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool safelink-decoder "https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com&data=..."New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/safelink-decoder/?url=https%3A%2F%2Fnam12.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fexample.com%26data%3D...&per_line=trueMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.