Split a link into protocol, host, port, path, query and fragment, as the browser does.
Link Unwrapper
Runs locallyNew
Use Link Unwrapper
What it does
Paste one or more rewritten links, or a whole message, to see every wrapper layer, the final destination in defanged form and warning signs such as a user name before @, an IP host or punycode.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Safe Links around URL Defense
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Flogin.example.com%40198.51.100.7%2Fverify*id%3D1__%3BPw!!AbCdEf!GhIjKl%24&data=05%7C02%7C%7Cc0ffee%7C0&reserved=01 link: 1 unwrapped, 1 with warnings.
Result 2 layers
Microsoft Defender Safe Links url
→ hxxps://urldefense[.]com/v3/__https://login[.]example[.]com[@]198[.]51[.]100[.]7/verify*id=1__;Pw!!AbCdEf!GhIjKl$
Proofpoint URL Defense path __…__ with 1 replaced character(s)
→ hxxps://login[.]example[.]com[@]198[.]51[.]100[.]7/verify?id=1
Destination
hxxps://login[.]example[.]com[@]198[.]51[.]100[.]7/verify?id=1
Copy raw
The URL has a user-info part before "@" ("login[.]example[.]com"). Browsers ignore it and go to 198[.]51[.]100[.]7.
The host is a bare IP address (198[.]51[.]100[.]7) instead of a domain name.Two layers: Microsoft Defender Safe Links, then Proofpoint URL Defense v3, which restores the ? hidden behind *. The destination hxxps://login[.]example[.]com[@]198[.]51[.]100[.]7/verify?id=1 is flagged: the text before @ is only a user name and the real host is the IP 198.51.100.7.
FAQ
Which wrappers does it decode?
Microsoft Defender Safe Links, Proofpoint URL Defense v1, v2 and v3, Google /url and Ads links, Facebook, Instagram and Messenger link shims, LinkedIn, Barracuda, Cisco Secure Email, Trend Micro, Sophos, Bing, Steam, Slack, YouTube and VK redirects, plus url=, u=, q=, target=, to=, dest=, redirect= or link= parameters that hold a URL. Nested wrappers are decoded one layer at a time.
Why are t.co, lnkd.in and Mimecast links not fully decoded?
Shorteners such as t.co and lnkd.in store the destination on their own servers, so the tool shows a curl -sI command that prints the Location header without opening the page. Mimecast links only carry the destination domain; the full address stays with Mimecast.
Is the link opened or sent anywhere?
No. Decoding is text processing on this page: no request goes to the wrapper service, the shortener or the destination. The curl command is only shown for you to run yourself, ideally from an isolated machine.