Proofpoint URL Defense decoder
Paste a urldefense.proofpoint.com or urldefense.com link to see the original address inside it. Decoding happens instantly, without opening the link.
How Proofpoint rewrites links
Proofpoint URL Defense rewrites links in incoming email so it can check them when you click. Older links look like urldefense.proofpoint.com/v2/url?u=…, newer ones like urldefense.com/v3/__https://…__;…!!….
In v2 links the address is encoded with dashes and underscores; in v3 links most of it is readable, with special characters stored separately. The decoder handles all three versions and puts the original address back together.
Decoding is useful to share a clean link, check a link before clicking it, or investigate a reported phishing email.
What this decoder handles
- urldefense.proofpoint.com/v1/url?u=…
- urldefense.proofpoint.com/v2/url?u=…
- urldefense.com/v3/__…__;…!!…
- Proofpoint links wrapped inside other redirects
Questions
What does the v3 format look like?
urldefense.com/v3/__https://example.com/page__;!!ABC123!… The part between the double underscores is the original address, with special characters replaced by * and restored from the encoded section after the semicolon.
Is it safe to click the decoded link?
Decoding only shows the address. Clicking the original skips Proofpoint’s click-time check, so trace it first if you are unsure.