Email link decoder
Paste a link copied from an email. We unwrap security and redirect wrappers instantly, without opening the link, and show you the address underneath.
Why email links look so long
Company email security tools rewrite every link so they can check it when you click. Microsoft Safe Links, Proofpoint URL Defense and Barracuda Link Protection all do this, and the original address is hidden inside the new one.
Marketing emails wrap links too, so the sender can count clicks. SendGrid, Mailchimp, HubSpot and Klaviyo store the destination on their own servers, so those links can only be followed, not decoded.
Scammers rely on that noise: a phishing link inside a long, official-looking wrapper is easy to miss. Decoding shows you the address that actually matters.
What this decoder handles
- Microsoft Safe Links (Outlook, Microsoft 365, Teams)
- Proofpoint URL Defense (v1, v2 and v3)
- Barracuda Link Protection
- Google, Facebook, Instagram, LinkedIn, Slack, YouTube and Steam redirects
- Destinations hidden in url=, u=, redirect= and similar parameters, including base64
- Tracking links from SendGrid, Mailchimp, Mimecast, HubSpot, Klaviyo, Mailgun, Amazon SES and Constant Contact (followed with our tracer)
Questions
Does decoding a link open it?
No. Wrapped links are decoded on our server from the text of the link alone; nothing is visited. Tracking links can’t be decoded, so for those we offer to follow them with our tracer instead.
Do you store the links I paste here?
No. Wrapped links can include your email address, so the decoder doesn’t log what you paste. If you choose to trace the decoded destination, only that destination is checked.
Is a link safe if it was wrapped by my company’s email security?
The wrapper means your company checks the link when you click it, which helps, but brand-new scam pages can pass. Look at the decoded address before you trust it.