Does unwrapping a SafeLink tell me if it's safe to click?

No, it only decodes the destination URL encoded in the wrapper's query string; whether that destination is malicious is a separate judgment call you still have to make yourself.

Does this tool visit or fetch the link to check it?

No, it never makes a network request to the wrapper or the destination, it just parses the pasted text locally and reads the url-style parameter already present in the string.

Why does it say no wrapped URL was found?

That means none of the checked parameter names (url, u, q, target) held a value that decodes to something starting with http:// or https://, which happens with wrappers that use a different scheme or an opaque ID instead.

Can it unwrap links from services other than Outlook?

Yes, for any redirect wrapper that puts the real destination in a url, u, q or target query parameter, which covers a number of generic link shorteners and forwarders, not only Microsoft's SafeLinks format.

SafeLink Decoder

Unwrap Outlook SafeLinks and similar redirect URLs to reveal the real destination, locally.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Unwrap a SafeLinks or redirect URL to see where it actually goes

Microsoft's Outlook ATP SafeLinks, and many other link-tracking wrappers, rewrite the original link into a long URL on their own domain with your actual destination stored in a query parameter. This tool parses the wrapper, checks common parameter names, and decodes the one that looks like a real http or https URL. It's useful before clicking a suspicious-looking forwarded email link, and since it only parses text you paste, the link itself is never fetched or requested.

How to use the SafeLink Decoder

Paste the full wrapped link, including the safelinks.protection.outlook.com host and its query string, into the input box.
Read the Destination line for the decoded URL the wrapper was pointing to.
Copy the destination or use Send To if you want to inspect it further with the URL parser.
Treat the decoded link as unverified, decoding tells you where it points, not whether that site is safe.

The decoder looks for a url, u, q or target query parameter on the pasted link and only accepts a value if, once percent-decoded, it starts with http:// or https://; anything else is reported as not found rather than guessed at.

This covers Outlook SafeLinks and most simple redirect wrappers built the same way, but click-tracking services that store the destination in an opaque token or a server-side lookup instead of a plain URL parameter can't be unwrapped this way.

Frequently asked questions

Does unwrapping a SafeLink tell me if it's safe to click?: No, it only decodes the destination URL encoded in the wrapper's query string; whether that destination is malicious is a separate judgment call you still have to make yourself.
Does this tool visit or fetch the link to check it?: No, it never makes a network request to the wrapper or the destination, it just parses the pasted text locally and reads the url-style parameter already present in the string.
Why does it say no wrapped URL was found?: That means none of the checked parameter names (url, u, q, target) held a value that decodes to something starting with http:// or https://, which happens with wrappers that use a different scheme or an opaque ID instead.
Can it unwrap links from services other than Outlook?: Yes, for any redirect wrapper that puts the real destination in a url, u, q or target query parameter, which covers a number of generic link shorteners and forwarders, not only Microsoft's SafeLinks format.