Free email tool

Free Safe Links Decoder: Unwrap Microsoft SafeLinks & Proofpoint URLs

A Safe Links decoder pulls the original destination back out of a wrapped link without opening it. Microsoft Defender Safe Links and Proofpoint URL Defense rewrite links in email so they can be scanned at click time; paste one below to see where it really goes.

Paste wrapped links or an email

Decoding runs entirely in your browser. Links are never fetched, followed, uploaded or stored.

Try a sample

One link, several links (one per line), or a whole email. Decodes Microsoft Safe Links, Proofpoint v1/v2/v3, Barracuda and Google redirect links; detects Mimecast.

Decoded links

Paste links and select Decode links, or try a sample. Each link's original destination will appear here.

How to decode a Safe Links URL

  1. 1

    Copy the wrapped link without clicking it

    In Outlook or any mail app, right-click the link and choose Copy link (or copy the whole email body). Don't click the link itself.

  2. 2

    Paste it into the Safe Links decoder

    Paste one link, several links (one per line) or the whole email, then select Decode links. Decoding runs in your browser; the link is never opened.

  3. 3

    Check the original destination

    Read the decoded URL, the highlighted domain and any safety notes. If anything looks wrong, don't open it; report the email or ask your IT team.

How Safe Links and URL Defense rewriting works

Email security gateways replace every link in a message with a link to their own server. When you click, the gateway scans the destination and then redirects you. Most formats keep the original address inside the wrapped link, which is why it can be decoded. Highlighted parts carry the destination.

Microsoft Defender Safe Links (Outlook, Microsoft 365)

https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.example.com%2Finvoice&data=05%7C02%7C...&sdata=...&reserved=0

https://nam12.safelinks.protection.outlook.com/
Microsoft's Safe Links prefix. The first label is the data center (nam01, eur02, gcc02 and so on).
?url=https%3A%2F%2Fwww.example.com%2Finvoice
The url parameter carries the original destination, percent-encoded.
&data=05%7C02%7C...&sdata=...&reserved=0
Microsoft metadata. Not needed to find the destination.

Not every link is wrapped: admins can exclude URLs or check links through the Safe Links API without rewriting them.

Proofpoint URL Defense v2

https://urldefense.proofpoint.com/v2/url?u=https-3A__www.example.com_path-3Fa-3D1&d=DwMFaQ&c=...&r=...&m=...&s=...&e=

https://urldefense.proofpoint.com/v2/url
Proofpoint prefix and version.
?u=https-3A__www.example.com_path-3Fa-3D1
The u parameter: percent-encoding with - in place of % and _ in place of /.
&d=DwMFaQ&c=...&r=...&m=...&s=...&e=
Proofpoint metadata. Version 1 links use u=...&k= and plain percent-encoding.

Decoded: https://www.example.com/path?a=1

Proofpoint URL Defense v3

https://urldefense.com/v3/__https://google.com:443/search?q=a*test&gs=ps__;Kw!-612Flbf0...!Ue6tQudNKa...$

https://urldefense.com/v3/
Proofpoint v3 prefix.
__https://google.com:443/search?q=a*test&gs=ps__
The destination between double underscores. Each * (or **X run) is a placeholder for characters stored separately.
;Kw
The replaced characters, base64url-encoded (Kw is +).
!-612Flbf0...!Ue6tQudNKa...$
Proofpoint metadata. Not needed to decode.

Decoded: https://google.com:443/search?q=a+test&gs=ps

Barracuda Link Protection

https://linkprotect.cudasvc.com/url?a=http://www.codestore.net&c=E,1,5bEVim247z1f...&typo=1

https://linkprotect.cudasvc.com/url
Barracuda Email Gateway Defense prefix.
?a=http://www.codestore.net
The a parameter carries the original destination.
&c=E,1,5bEVim247z1f...&typo=1
Barracuda metadata (typo=1 is not documented).

Example from Barracuda's own documentation. Links in encrypted messages, attachments or on the exemption list aren't rewritten.

Google redirect link

https://www.google.com/url?q=https%3A%2F%2Fexample.com%2F&sa=D&ust=...&usg=...

https://www.google.com/url
Google's redirect endpoint (seen in Gmail and Google Docs).
?q=https%3A%2F%2Fexample.com%2F
The q parameter (or url on some variants) carries the destination.
&sa=D&ust=...&usg=...
Google metadata.

This format is observed, not officially documented by Google.

Mimecast URL Protect (can't be decoded)

https://protect-us.mimecast.com/s/Xk7pCQWJr2fGKxNtYLm3q?domain=example.com

https://protect-us.mimecast.com/s/
Mimecast prefix. Newer links use hosts like url.uk.m.mimecastprotect.com.
Xk7pCQWJr2fGKxNtYLm3q
An opaque code. The destination is stored by Mimecast, not in the link.
?domain=example.com
Sometimes present: the destination domain only.

Only Mimecast administrators can decode these, in the Mimecast console or with its Decode URL API.

Supported link formats and sources

Formats and decoding rules were checked October 28, 2026 against the vendors' own documentation and tools. Links from other services (for example Cisco, Trend Micro, Sophos or Avanan) are not decoded by guesswork.

Sources checked October 28, 2026. Domains are highlighted with a small built-in list of two-part suffixes (like co.uk and com.au), so they are approximate.

Frequently asked questions

What is safelinks.protection.outlook.com, and is it safe?

It is Microsoft's own Safe Links domain, part of Microsoft Defender for Office 365. When your organization turns Safe Links on, links in email are rewritten to an address like https://nam01.safelinks.protection.outlook.com/?url=... so Microsoft can scan the destination when you click. The wrapper is legitimate, but it says nothing about whether the destination is safe. Only host names ending in .safelinks.protection.outlook.com are real; a name like safelinks.protection.outlook.com.example.net is not Microsoft.

How do I decode a Proofpoint urldefense link?

Paste it into the decoder above. Proofpoint URL Defense v1 and v2 links (urldefense.proofpoint.com) carry the destination in the u parameter; v2 also swaps % for - and / for _. Version 3 links (urldefense.com/v3/) put the destination between double underscores, with some characters replaced by * and stored in base64 after the semicolon that follows. The decoder follows Proofpoint's published decoding steps and runs entirely in your browser.

Why are my links wrapped, and how do I see the original link in Outlook?

Your organization's email security service (Microsoft Defender for Office 365 Safe Links, Proofpoint, Barracuda or Mimecast) rewrites links so they can be checked when someone clicks. Hovering over a link in Outlook shows the long wrapped address, not the destination. To see the original link without opening it, right-click the link, choose Copy link, and paste it here.

Can you decode Mimecast links?

No. Mimecast URL Protect links (such as protect-us.mimecast.com or url.uk.m.mimecastprotect.com) contain an opaque code, not the destination, so no website can decode them offline. Some include a domain= parameter, which this tool shows as the destination domain only. Mimecast administrators can decode a link in the Mimecast console or with its Decode URL API, so ask your IT or security team.

Is it safe to open the decoded link?

Not necessarily. Opening the decoded address directly skips your security gateway's click-time scan, which is the reason the link was wrapped. Check the domain and any notes first, use a link checker if you're unsure, and if the email was unexpected, don't open it: report it or ask your IT team.

Related tools

Phishing Email Checker

Paste a suspicious email to check the sender, lookalike domains, links and scam wording.

Email Header Analyzer

Trace every server hop and read SPF, DKIM and DMARC results from full headers.

EML Viewer

Open an .eml file in your browser to inspect headers, parts and attachments safely.

Mailto Link Generator

Build mailto: links with subject, body, CC and BCC, correctly encoded.

URL Safety Checker

Check a single decoded link on Lie Library before you open it.

Browse all free email tools

Extract and normalize links automatically

Developers: the MailParse inbound email parsing API turns every incoming email into clean JSON, with headers, bodies, links and attachments, delivered to your webhook so your code can extract and normalize links without copying them by hand.

Try MailParse free