Safelink Decoder

An email arrives with a link, and hovering over it shows nam11.safelinks.protection.outlook.com followed by three hundred characters of encoded junk. There is no way to tell whether the destination is your company portal or a lookalike domain registered yesterday. Clicking to find out is exactly what you should not do when the message is already suspect.

When a wrapper stores the destination in a query parameter, you read that parameter and undo the percent-encoding. The tool checks the known parameter for each service and, failing that, takes any parameter whose value starts with http or https, which is why it also cracks unknown redirectors shaped like ?redirect=. Wrappers that hide the target in the URL path as base64, such as SES, SendGrid and Mimecast, only get identified by name: there is nothing in the query to decode.

Paste one link at a time; two pasted together return nothing, since the parser expects a single URL. Decoding is not vetting: the revealed address can still be phishing, so read the domain right to left before you decide. If the destination path contains legitimate percent-encoding, compare it against the original, because decoding can go one step further than it should. Nothing is opened or uploaded; the parsing happens in your browser.