Microsoft Safe Links Decoder

Microsoft Safe Links (part of Microsoft Defender for Office 365) rewrite URLs in email and Microsoft 365 apps. At click time, the rewritten link is checked for malicious behavior before the user is allowed through.

Paste the full Safe Link URL into the decoder above and click Decode. The tool extracts the url= parameter, URL-decodes it, and displays the original destination — without making any outbound connection to the target site.

Any URL containing *.safelinks.protection.outlook.com or *.safelinks.office.com is a Microsoft Safe Link. Microsoft rewrites outbound URLs in Outlook and Microsoft 365 to this hostname so it can inspect the destination at click time. The original URL is embedded in the long query string as the url= parameter.

• See the true destination without clicking
• Speed up phishing triage and incident response
• Check reputation in a sandbox or SIEM
• Build allow/deny lists accurately
• Remove tracking parameters for cleaner logs

Look for hostnames like *.safelinks.protection.outlook.com or *.safelinks.office.com containing a long query string with url= — the encoded original link.

No. Decoding is read-only. Always open suspicious targets in a sandbox or analysis VM, not on your primary workstation. We have a sandbox phishing checker that safely analyzes links for you.

Partially. Decoding just reveals the url= value — your Safe Links policies still protect users at click time inside Microsoft 365. However, if you follow a decoded link directly in your browser (bypassing the safelinks.protection.outlook.com redirect), that click will not be inspected by Safe Links.

url= is the original destination (URL-encoded). Others like data=, sdata=, h=, and reserved= are integrity and routing metadata used by Microsoft — they are not needed to decode the link.

Yes. Decoding lets you confirm the real destination, test direct access in a sandbox, and decide if a policy exception (do-not-rewrite) is justified.

The decoder can optionally strip marketing/tracking parameters (e.g., UTM tags) for privacy and cleaner analytics — when appropriate.

Nearly always. Time-of-click checks catch delayed activations and payload swaps that traditional filters may miss.

Yes, via a do-not-rewrite list in Defender for Office 365. Use it sparingly and review entries regularly.

Yes. These services can also produce Safe Links, and the same decoding approach applies.

Safe Links is one feature within Microsoft Defender for Office 365 (formerly ATP). Defender for Office 365 also includes Safe Attachments, anti-phishing policies, and threat intelligence. Safe Links specifically handles URL rewriting and time-of-click verification.