# Link Unwrapper

URL: https://phishdestroy.io/developer-tools/link-unwrapper
Category: Phishing URL & domain
Where it runs: Runs locally (nothing you enter is uploaded)

Paste one or more rewritten links, or a whole message, to see every wrapper layer, the final destination in defanged form and warning signs such as a user name before @, an IP host or punycode.

## Example input

Safe Links around URL Defense

```
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Flogin.example.com%40198.51.100.7%2Fverify*id%3D1__%3BPw!!AbCdEf!GhIjKl%24&data=05%7C02%7C%7Cc0ffee%7C0&reserved=0
```

Two layers: Microsoft Defender Safe Links, then Proofpoint URL Defense v3, which restores the ? hidden behind *. The destination hxxps://login[.]example[.]com[@]198[.]51[.]100[.]7/verify?id=1 is flagged: the text before @ is only a user name and the real host is the IP 198.51.100.7.

## FAQ

### Which wrappers does it decode?

Microsoft Defender Safe Links, Proofpoint URL Defense v1, v2 and v3, Google /url and Ads links, Facebook, Instagram and Messenger link shims, LinkedIn, Barracuda, Cisco Secure Email, Trend Micro, Sophos, Bing, Steam, Slack, YouTube and VK redirects, plus url=, u=, q=, target=, to=, dest=, redirect= or link= parameters that hold a URL. Nested wrappers are decoded one layer at a time.

### Why are t.co, lnkd.in and Mimecast links not fully decoded?

Shorteners such as t.co and lnkd.in store the destination on their own servers, so the tool shows a curl -sI command that prints the Location header without opening the page. Mimecast links only carry the destination domain; the full address stays with Mimecast.

### Is the link opened or sent anywhere?

No. Decoding is text processing on this page: no request goes to the wrapper service, the shortener or the destination. The curl command is only shown for you to run yourself, ideally from an isolated machine.

## Related tools

- [URL Parser](https://phishdestroy.io/developer-tools/url-parser)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [Multi-Layer Decoder](https://phishdestroy.io/developer-tools/multi-layer-decoder)
- [QR Code Decoder](https://phishdestroy.io/developer-tools/qr-decoder)
- [URL Encoder / Decoder](https://phishdestroy.io/developer-tools/url-encoder-decoder)

All tools: https://phishdestroy.io/developer-tools