Proofpoint URL Decoder
Reveal original destinations wrapped by Proofpoint URL Defense v2 and v3
Decoding only reveals the destination; it does not visit, scan, or certify the target.
The v2/v3 version, target host, and original URL will appear here.
About this tool
Proofpoint URL Decoder extracts the original destination from URL Defense v2 and v3 wrappers used in protected email links. It recognizes supported Proofpoint hosts, decodes v2 hexadecimal and slash substitutions, handles v3 payload and replacement data, and reports the destination host without opening it. A decoded URL is not a safety verdict; it only makes the target visible for review. All parsing runs locally and no link is requested.
Scenario Recipes
Review a protected email link before opening it
Goal: Expose the destination host without triggering a web request
- Paste the complete URL Defense link from the message.
- Decode it and review both the original URL and host.
- Use an approved security scanner if the destination remains suspicious.
Result: A visible destination suitable for a separate security decision.
Frequently Asked Questions
Which Proofpoint formats are supported?
The decoder supports common URL Defense v2 query-parameter links and v3 path payload links.
Does decoding visit the destination?
No. It only parses characters already present in the wrapper and never requests the original site.
Does a decoded URL mean the website is safe?
No. Decoding reveals the destination but does not perform phishing, malware, reputation, or content scanning.
Why can some customized Proofpoint links fail?
Organizations and products can emit variants outside the common v2/v3 formats. An unsupported structure is reported instead of guessed.
Can I decode several links at once?
Yes. Paste one Proofpoint URL per line to produce a batch of destinations.
Are wrapped links uploaded?
No. URL recognition and decoding happen entirely in the browser.
Keep browsing