SafeLinks Decoder
Paste a rewritten email link and read the URL underneath it.
Only the first 8 KB of what you pasted was read. Paste just the link itself for a complete answer.
Original URL
Decode chain
What this tells you, and what it doesn't
Mail security gateways rewrite the links in a message so that clicks route through them first. The address you end up looking at in the message is the gateway's, and the one you actually wanted is buried inside it. This page pulls it back out.
That is the whole job. Recovering a URL is not a judgement about it. This tool identifies and reverses the rewriting; it says nothing about whether the destination is safe, and it never visits the address to find out. Treat what comes back the way you would treat any link from a message you were already unsure about.
Everything runs in your browser: the link is never sent to this site or anywhere else, no request is made to the decoded address, and the result is deliberately plain text rather than something clickable.
Where these links usually turn up
Most often while reading a message's raw source — which is also where the rest of the story is. The Email Header Analyzer takes the same raw source and walks the delivery path, authentication results, and sender alignment. If the message bounced instead of arriving, Why Did This Email Fail? translates the bounce code into what actually went wrong.
Gateways it recognises
| Gateway | What the link looks like | Result |
|---|---|---|
| Microsoft Defender SafeLinks | nam02.safelinks.protection.outlook.com/?url=… | Decoded |
| Proofpoint URL Defense v1 and v2 | urldefense.proofpoint.com/v2/url?u=… | Decoded |
| Proofpoint URL Defense v3 | urldefense.com/v3/__…__;…$ | Decoded |
| Barracuda Link Protect | linkprotect.cudasvc.com/url?a=… | Decoded |
| Cisco Secure Email | secure-web.cisco.com/<token>/… | Decoded |
| Mimecast URL Protection | protect-eu.mimecast.com/s/<token>url.us.mimecastprotect.com/s/<token> | Identified only |
Mimecast is the exception, and not because of a gap here. Every other gateway carries the original URL inside the rewrite, encoded but intact. Mimecast's token is a lookup key into the gateway that issued it — the destination only exists on Mimecast's side, so there is nothing in the link to decode. This page names the vendor and stops rather than guessing.
Nesting is handled: a message that crossed a Proofpoint gateway and was then forwarded into a Microsoft tenant arrives wrapped twice, and each layer is unwrapped in turn until the original is reached.