Microsoft Safe Link Decoder

No. The decoder processes the pasted URL locally in your browser using JavaScript. The decoder does not submit the URL to ITKB and does not open the destination website.

If you choose to send the decoded destination to the ITKB Phishing Scanner, that is a separate action. The scanner sends the URL to the ITKB backend so it can inspect redirects, screenshots, forms, scripts, DNS records, and other security indicators.

Microsoft Safe Links (part of Microsoft Defender for Office 365) rewrite URLs in email and Microsoft 365 apps. At click time, the rewritten link is checked for malicious behavior before the user is allowed through.

Paste the full Safe Link URL into the decoder above and click Decode. The tool extracts the url= parameter, URL-decodes it, and displays the original destination locally in your browser without opening the destination website.

Any URL containing *.safelinks.protection.outlook.com or *.safelinks.office.com is a Microsoft Safe Link. Microsoft rewrites outbound URLs in Outlook and Microsoft 365 to this hostname so it can inspect the destination at click time. The original URL is embedded in the long query string as the url= parameter.

• See the true destination without clicking
• Speed up phishing triage and incident response
• Check reputation in a sandbox or SIEM
• Build allow/deny lists accurately
• Remove tracking parameters for cleaner logs

Look for hostnames like *.safelinks.protection.outlook.com or *.safelinks.office.com containing a long query string with url= — the encoded original link.

No. Decoding reveals the destination but does not establish whether it is trustworthy. Do not open a suspicious destination directly on your primary workstation. For deeper remote analysis, submit it separately to the ITKB Phishing Scanner, which sends the URL to the ITKB backend and returns evidence such as redirects, screenshots, forms, scripts, DNS records, and other indicators.

Decoding only reveals the destination embedded in the url= parameter; it does not change your Microsoft 365 Safe Links policies. If you open the decoded destination directly, the request no longer passes through the Safe Links redirect and its time-of-click inspection. Other browser, endpoint, DNS, or network protections may still apply. Do not treat a decoded URL as trustworthy solely because it was wrapped by Safe Links.

url= is the original destination (URL-encoded). Others like data=, sdata=, h=, and reserved= are integrity and routing metadata used by Microsoft — they are not needed to decode the link.

Yes. Decoding reveals the actual destination so you can compare it with the expected domain and investigate it using other evidence. Review the destination, redirect behavior, domain information, and organizational context before creating a Safe Links policy exception.

The decoder can optionally strip marketing/tracking parameters (e.g., UTM tags) for privacy and cleaner analytics — when appropriate.

Nearly always. Time-of-click checks catch delayed activations and payload swaps that traditional filters may miss.

Yes, via a do-not-rewrite list in Defender for Office 365. Use it sparingly and review entries regularly.

Yes. These services can also produce Safe Links, and the same decoding approach applies.

Safe Links is one feature within Microsoft Defender for Office 365 (formerly ATP). Defender for Office 365 also includes Safe Attachments, anti-phishing policies, and threat intelligence. Safe Links specifically handles URL rewriting and time-of-click verification.