Malicious URL Decoder & Deobfuscator

Paste a link from an email, chat, log or sandbox and see what it actually does. Percent-encoding layers are peeled one by one and common phishing/obfuscation tricks are flagged automatically.

Open the Tool

Why use Malicious URL Decoder?

Peels up to 8 layers of percent-encoding and shows the fully decoded URL

Flags obfuscation: decimal / hex IP hosts, punycode, '@' userinfo decoys, non-ASCII homograph domains, whitespace tricks

Separates the real host from decoy text placed before an '@'

100% client-side - nothing is fetched, opened, or sent anywhere

How it works

  1. Copy the suspicious link from email, chat, logs, or a sandbox report.
  2. Paste it above - surrounding text is fine, the URL is located automatically.
  3. Read the decoded URL and the 'Suspicious signals' checklist.

FAQ

Is it safe to paste a malicious URL here?

Yes. The tool never opens or fetches the link - it only decodes and parses the string locally in your browser.

What does 'double-encoded' mean?

Attackers encode characters more than once (e.g. %252F hides a %2F, which is itself a /). This tool decodes all layers and tells you how many there were.

What is an '@' userinfo decoy?

In https://paypal.com@evil.example, browsers treat everything before the last '@' as login info and connect to what follows it. This tool always shows you the real host after the '@'.