Outlook Safelink decoder

Microsoft Defender for Office 365 rewrites links in incoming emails so they pass through its Safe Links scanning service. A simple link becomes a long URL such as https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Fpage&data=...&sdata=.... This decoder extracts the original destination so you can read where the link really goes, share the clean URL or document it.

How to use it

1. Paste the Safe Links URL from the email, or right-click the link and copy the address.
2. Read the decoded original URL.
3. Copy it for sharing or inspection.

How it works

The original destination is stored in the url query parameter, percent-encoded. Decoding it turns https%3A%2F%2Fexample.com%2Fpage into https://example.com/page. The other parameters, such as data, sdata and reserved, contain tenant and tracking information used by Microsoft and are not needed to reach the destination.

When this is useful

• Checking suspicious emails without clicking: see the real domain first.
• Sharing links with people outside your organisation, who otherwise receive an ugly, possibly non-working link.
• Documentation and tickets, where clean URLs are easier to read.

Security notes

• Decoding bypasses the click-time scan. If you open the decoded link directly, you lose Microsoft's protection, so only do this for links you have checked.
• Look carefully at the decoded domain: phishing links often use look-alike domains such as rnicrosoft.com.
• Decoding happens in your browser; the link is not visited or sent anywhere.