SafeLinks & URL Wrapper Decoder
Recover the original URL from a Microsoft SafeLinks, Proofpoint or Barracuda rewritten link.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
Mail-security services can wrap URLs so clicks pass through a protection service. Microsoft Safe Links behavior depends on policy and client: supported Outlook clients can show the original destination on hover, and some policies check links through an API without rewriting them. A wrapped URL copied into a ticket or plain text can still be difficult to inspect. This decoder reads Microsoft SafeLinks' url parameter, Proofpoint URL Defense v1/v2's encoded u parameter, and Barracuda's a or legacy url parameter. Proofpoint v3 is detected but not decoded by this tool. Everything runs in your browser; neither the wrapper nor its destination is fetched.
How it works
Microsoft SafeLinks: url parameter → destination Proofpoint v1/v2: u parameter → decode substituted escapes → destination Barracuda: a (current) or url (legacy) parameter → destination Proofpoint v3: detected only → skeleton, not a decoded destination
Paste one wrapped link. This tool reads the encoded destination from supported formats without requesting the wrapper or destination. It unwraps one layer; another wrapper needs a separate pass. The synthetic examples below use example.com and contain no real recipient data. Recovering a URL does not verify its safety, the gateway's signature or the sender's identity. Unrecognized wrappers and plain URLs do not produce a decoded destination.
| Question | Working | Answer |
|---|---|---|
| Microsoft SafeLinks | https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Freport%3Fquarter%3D1 | https://example.com/report?quarter=1 |
| Barracuda Link Protection | https://linkprotect.cudasvc.com/url?a=https%3A%2F%2Fexample.com%2Finvoice%3Fid%3D42 | https://example.com/invoice?id=42 |
| Proofpoint URL Defense v3 | https://urldefense.com/v3/__https://example.com/p*3Fa*3D1__;JQ!example | Detected but not decoded; skeleton: https://example.com/p★3Fa★3D1 |
When to use it
Questions
Recovering the real URL — does that mean it's safe to visit?
No. Decoding recovers the destination encoded in the pasted text; it does not scan that destination or verify the gateway's signature, sender or identity. A wrapped link is not proof that its destination is malicious or safe. Keep your organization's protection workflow and assess the destination before visiting it.
Does Microsoft Safe Links always rewrite links or hide their hover preview?
No. Wrapping depends on the configured policy and client. Microsoft's documentation describes original-URL hover previews and supported Outlook clients that can perform time-of-click API checks without rewriting URLs. This tool is useful for inspecting wrapped URLs copied as text; it does not replace those protections.
Why doesn't this tool decode Proofpoint v3 links?
This decoder implements Proofpoint v1/v2 parameter decoding, but not v3's character substitutions. For a recognized v3 link it shows a skeleton with ★ marking substituted characters, not a recovered destination. Do not treat that skeleton as a complete URL or replace those markers by guessing.
The decoded URL still looks like another redirect or shortener — now what?
The tool unwraps one layer. If the result is another supported wrapper, paste it again for another pass. An opaque shortener cannot be resolved by parsing alone. Following redirects requires a network request; the site's Redirect Checker uses a server and contacts the destination, unlike this offline decoder.
Why did the wrapped link change or stop working after I forwarded the email?
The copied text may have changed, or the protection service may handle the link differently. This decoder cannot diagnose forwarding, expiry or service availability because it never requests the link. It only reads the supported destination field in the text you provide.
Does the decoder validate Microsoft's data or sdata parameters?
No. It reads the url destination parameter and does not validate the other fields or their signatures. Similarly, it reads u for Proofpoint v1/v2 and a or url for supported Barracuda formats. A decoded result is not a validation of the complete wrapper.
What happens with an unsupported wrapper or an ordinary URL?
The tool reports that the text does not match a recognized format and shows no decoded destination. Microsoft SafeLinks, Proofpoint v1/v2 and supported Barracuda formats can be decoded; Proofpoint v3 is detected only. A plain URL does not need unwrapping.
Does this tool visit or save the link I paste?
No. It parses the link in your browser without fetching the wrapper or destination, and does not save the pasted link. Copy URL puts a decoded destination on your clipboard only when you choose it. Decoding does not establish that the destination is safe.