Overview
Extracts the real destination URL from wrapped and tracked links - Microsoft SafeLinks, Google redirect URLs and Facebook u-parameter wrappers - entirely in your browser. Paste the wrapped link, get the clean destination, and see where a mail or chat link actually leads before you click it.
How It Works
Paste the wrapped URL into the box. The tool parses it and, when it recognizes the wrapper, displays the decoded destination below with a copy button. Unrecognized links are returned unchanged, which is itself information: you can see at a glance that the link is not one of the three known wrapper families. No request is ever made to any URL you paste.
Step-by-Step Usage Guide
- Copy the full wrapped link from your email client or chat, including all query parameters.
- Paste it into the input box. Parsing happens as you type, with no button to press.
- Read the destination shown below. If the tool did not recognize the wrapper, the output matches your input - the link is not SafeLinks, Google or Facebook wrapped.
- Copy the clean URL if you want to archive or share the original destination without the tracking parameters.
Technical Specifications & Standards
Three wrapper families are handled, each by reading the destination out of a query parameter after real URL parsing. Microsoft Defender SafeLinks rewrites links through a host ending in safelinks.protection.outlook.com and carries the original in the url parameter, percent-encoded; Google wraps outbound clicks through a /url path with the target in q or url; Facebook uses a u parameter on its redirect endpoints. The tool uses the WHATWG URL parser to pull those parameters, so percent-encoding is decoded correctly rather than by fragile string splitting. Two honest boundaries: first, coverage is exactly those three families - Proofpoint URL Defense, desktop rewrites with different hostnames, and enterprise gateways with custom wrappers fall through unchanged; second, and more important, unwrapping is inspection, not protection. Seeing that a SafeLink points at example.com tells you where it goes; it does not tell you whether example.com is safe. The value is that link-rewrite chains obscure the destination at a glance, and this tool restores the visibility that the wrapping removed - without your browser ever touching the destination, which is exactly what clicking would do.
Targeted Use Cases
- Checking where an email link actually leads before clicking, when the visible text and the underlying href disagree.
- Removing tracking wrappers before sharing a link so recipients' clicks are not attributed through a redirector.
- Archiving the original destination of a SafeLink-wrapped link, which can change or expire when the protection tenant changes.
- Auditing a batch of newsletter links by pasting them one at a time and noting the true destinations.
Notes & Gotchas
- Treat the decoded destination as information, not clearance: knowing where a link goes is not the same as knowing it is safe.
- Compare the decoded domain against what the message claims - a bank link that decodes to an unrelated domain is phishing regardless of the wrapper.
- Do not paste links containing private tokens into tools you do not trust; this one parses locally and makes no requests, which is the property that matters.
- Expect partial coverage: other enterprise wrappers (Proofpoint, custom gateways) are not unwrapped and pass through unchanged.
Frequently Asked Questions
Is my URL sent anywhere?
No. The tool parses the string you paste with the browser's URL API and extracts query parameters entirely in the page. No network request is made to the wrapped URL, the destination, or anything else - which is the whole point of inspecting before clicking.
Why was my link returned unchanged?
The tool unwraps three families: Microsoft SafeLinks, Google /url redirects and Facebook u-parameter wrappers. Other rewriting services - Proofpoint URL Defense, corporate gateways - are not recognized, and the tool passes their links through rather than guessing.
Does decoding make a suspicious link safe to click?
No. Decoding shows you the destination; it says nothing about whether the destination is malicious. A phishing page behind a SafeLink is still a phishing page once unwrapped - the tool restores visibility, not safety.
Why decode at all if the email client shows a preview?
Previews show rewritten or truncated URLs, and SafeLinks chains can be hundreds of characters of redirect with the real destination buried percent-encoded in a parameter. Decoding restores the plain destination so you can judge the domain itself.