Question 1

How do I decode a Microsoft SafeLink URL?

Accepted Answer

Paste the full SafeLink URL (starting with https://nam*, https://eur*, https://apc* or https://urldefense.com) into the input field and click Decode. The real destination URL appears instantly — nothing is sent to our servers.

Question 2

What SafeLink formats are supported?

Accepted Answer

The tool decodes Microsoft Defender SafeLinks (nam/eur/apc prefixes, v1 and v2 formats), Proofpoint URL Defense (urldefense.com), and other common email security URL-rewriting proxies. Nested and multi-encoded SafeLinks are also supported.

Question 3

Is the decoded URL visited automatically?

Accepted Answer

No. The decoder performs a purely mathematical URL-unwrapping operation in your browser. The destination URL is never contacted, fetched or logged. This makes it safe to analyse potentially malicious links without exposing your environment to risk.

Question 4

What link formats are supported?

Accepted Answer

The tool decodes Microsoft SafeLinks URLs (nam*, eur*, apc* formats, v1 and v2), Proofpoint URL Defense links, and other URL-rewriting formats. It supports multiple and nested encodings.

Question 5

How do I use this tool in a phishing investigation?

Accepted Answer

Copy the SafeLink URL from the header or body of the suspicious email, paste it into the tool to get the real destination URL. Then combine it with our email analyzer and HTTP/certificate analyzer for a complete investigation.

SafeLink Decoder

Historique