Malicious URL Decoder & Deobfuscator

Paste a link from an email, chat, log or sandbox and see what it actually does. Percent-encoding layers are peeled one by one and common phishing/obfuscation tricks are flagged automatically.

Results update live as you type — no button needed. The Example button fills a sample input.

Why use Malicious URL Decoder?

Peels up to 8 layers of percent-encoding and shows the fully decoded URL

Flags obfuscation: decimal / hex IP hosts, punycode, '@' userinfo decoys, non-ASCII homograph domains, whitespace tricks

Separates the real host from decoy text placed before an '@'

100% client-side - nothing is fetched, opened, or sent anywhere

FAQ

Is it safe to paste a malicious URL here?

Yes. The tool never opens or fetches the link - it only decodes and parses the string locally in your browser.

What does 'double-encoded' mean?

Attackers encode characters more than once (e.g. %252F hides a %2F, which is itself a /). This tool decodes all layers and tells you how many there were.

What is an '@' userinfo decoy?

In https://[email protected], browsers treat everything before the last '@' as login info and connect to what follows it. This tool always shows you the real host after the '@'.

More Security & Forensics tools

🔧

Base64 Extractor & Decoder - Find & Decode Strings

Extract and decode Base64 strings from logs, dumps, and text. Fast, private, and browser-b
🔧

Code Deobfuscator - Decode Obfuscated Code Online

Free online code deobfuscator. Instantly decode URL-encoded obfuscation to reveal readable
🔧

Comcast Bill Analyzer - Compare Bills & Spot Hidden Changes

Compare two Comcast bills, terms, or emails side by side. Instantly highlight differences

🔧

Cron Time Analyzer - Cron Expression to Human Readable

Convert cron expressions to human-readable schedules and get warned about the risky 2-3 AM

← All tools · Security & Forensics