Outlook SafeLink Decoder
Free Outlook SafeLink decoder.
Loading tool...
What is Outlook SafeLink Decoder?
Outlook SafeLink Decoder is a browser-based analyzer for the wrapper URLs that Microsoft Defender for Office 365 injects into external email. Paste any safelinks.protection.outlook.com link and it unpacks the percent-encoded url= parameter to show the real destination, the regional processing prefix, the remaining tracking parameters, and objective phishing red flags in the destination - without ever visiting the link.
Key Benefits
- Reveal the true destination of a SafeLink before you click it
- Zero data leaves your browser - decoding is pure client-side JavaScript
- Instant red-flag analysis of the destination host and URL structure
- Batch-decode an entire digest email and copy all destinations at once
- Understand what tracking parameters Microsoft attaches to rewritten links
Common Use Cases
- •Security-aware employees verifying a suspicious link before opening it
- •IT help desks triaging reported phishing emails from Outlook users
- •Analysts inspecting which region processed a campaign's rewritten URLs
- •Compliance reviewers documenting link destinations in incident reports
- •Anyone who received a Defender-rewrapped link on a non-Outlook client and wants to see the original
How to Decode an Outlook SafeLink URL
- Copy the SafeLink URL: In Outlook, right-click the link in the email and choose Copy link - or copy the address from the email source. The URL contains safelinks.protection.outlook.com.
- Paste it into the tool: Paste one URL per line into the input box. You can decode a whole batch of links from a digest email in one go.
- Press Decode: The tool extracts the url= parameter, decodes it, and shows the original destination, the region prefix, and the remaining wrapper parameters.
- Review the red flags: Check the destination flags before opening the link. If the host is a raw IP, uses http, or imitates a brand via punycode, treat the email as suspicious.
Key Features
- Decodes any safelinks.protection.outlook.com wrapper back to the original destination URL
- Shows the regional prefix (nam, eur, apc, ...) and every remaining wrapper parameter
- Red-flag checks: http destinations, raw IP hosts, punycode lookalikes, user@host credentials, deep subdomains, double encoding
- Batch mode - paste one link per line and copy all destinations at once
- Warning banner reminds you to review the destination before opening it
- 100% client-side: nothing is visited, uploaded, or logged
Frequently Asked Questions
What is an Outlook SafeLink URL?
Microsoft Defender for Office 365 rewrites links in external email so they first pass through Microsoft's time-of-click verification, hosted on safelinks.protection.outlook.com (often with a regional prefix such as nam, eur, or apc). The original address is carried inside the wrapper's url= parameter, percent-encoded so it is not human-readable.
Does this tool open or visit the decoded destination?
No. The tool only parses the URL you paste and shows what it contains - it never requests the destination. That is also why you should still review the decoded address before opening it yourself.
Why is my link not recognized as a SafeLink?
Only URLs whose host is safelinks.protection.outlook.com (with or without a region prefix) are treated as SafeLinks. Other URLs are parsed and shown unchanged, and lines that are not valid URLs are flagged so you can spot truncation from copy-paste line breaks.
What do the red flags mean?
They are objective indicators often seen in phishing destinations rather than a verdict: http instead of https, a raw IP host, punycode (xn--) labels that can imitate lookalike domains, embedded user@host credentials, 4+ subdomain labels, extremely long URLs, and percent-escapes that survive decoding (double encoding).