Malicious URL Decoder & Deobfuscator

Paste a link from an email, chat, log or sandbox and see what it actually does. Percent-encoding layers are peeled one by one and common phishing/obfuscation tricks are flagged automatically.

Results update live as you type — no button needed. The Example button fills a sample input.

Why use Malicious URL Decoder?

Peels up to 8 layers of percent-encoding and shows the fully decoded URL

Flags obfuscation: decimal / hex IP hosts, punycode, '@' userinfo decoys, non-ASCII homograph domains, whitespace tricks

Separates the real host from decoy text placed before an '@'

100% client-side - nothing is fetched, opened, or sent anywhere

FAQ

Is it safe to paste a malicious URL here?

Yes. The tool never opens or fetches the link - it only decodes and parses the string locally in your browser.

What does 'double-encoded' mean?

Attackers encode characters more than once (e.g. %252F hides a %2F, which is itself a /). This tool decodes all layers and tells you how many there were.

What is an '@' userinfo decoy?

In https://paypal.com@evil.example, browsers treat everything before the last '@' as login info and connect to what follows it. This tool always shows you the real host after the '@'.

Example input

Try it with this sample — paste it into the box above:

https://www.paypal.com@2130706433/%25252Fcgi-bin%25252Flogin

How to use Malicious URL Decoder

  1. Enter or paste your data into the Your input box above.
  2. The result appears instantly in the Result box — everything runs in your browser, nothing is uploaded.
  3. Use Copy or Download to keep the result, or Example to load a sample first.

More Security & Forensics tools

🔧

Base64 Strings Extractor - Decode Every Blob in Forensic Text Dumps

Extract and decode every Base64 blob hidden in Cellebrite UFED exports, hex dumps or logs.
🔧

Code Deobfuscator - Decode Obfuscated Code Online

Free online code deobfuscator. Instantly decode URL-encoded obfuscation to reveal readable
🔧

Comcast Bill Analyzer - Compare Bills & Spot Hidden Changes

Compare two Comcast bills, terms, or emails side by side. Instantly highlight differences

🔧

Cron Time Analyzer - Cron Expression to Human Readable

Convert cron expressions to human-readable schedules and get warned about the risky 2-3 AM

Related tools

🔧

Crypto Phishing Detector - Check Suspicious URLs

Instantly detect crypto phishing URLs. Deobfuscate suspicious links, get a risk score, and
🔧

Email Phishing Guard - Deobfuscate & Preview Suspicious Links

Paste a suspicious email link to deobfuscate it, preview the real destination, and get ris
🔧

Metascraper URL Converter – Clean Obfuscated URLs for SEO

Convert messy, obfuscated URLs into clean, readable links. Improve link previews and SEO w
🔧

Esports Vote Scam Analyzer | Deobfuscate Phishing URLs

Unmask phishing links disguised as esports voting pages. Paste a suspicious URL, HTML, or

🔧

Esports Phishing Link Checker & URL Deobfuscator

Unmask fake esports league voting scam links. Deobfuscate suspicious URLs, reveal real des
🔧

Phishing Link Analyzer – Check Suspicious URLs

Analyze suspicious URLs for obfuscation and phishing attempts. Decode hidden links to see

← All tools · Security & Forensics