Defang / Refang URL
Defang links, domains, IPs and emails (hxxps://evil[.]example) so nobody clicks them by accident, and refang them back. Private, in your browser.
Text
Stays in your browserResult
The result appears here after you press Convert.
Shortcuts: Ctrl+Enter run · Ctrl+Shift+C copy result · / search (use ⌘ on Mac)
Free Online Defang / Refang URL
Write a dangerous link in a way that cannot be clicked, so it is safe to put in a report, an email or a chat. Turn it back into a normal link when you need to look at it. It gives developers a quick browser-based way to solve a focused defang / refang url task before moving the result into a project.
How to use Defang / Refang URL
Paste the text in the box on the left, then press Run. Choose Defang to make links, domains, IP addresses and emails safe, or Refang to restore them.
Common mistakes
- Defanging a link and then clicking it: the result is meant for reports, not for browsing.
- Pasting only part of a link: a domain without a known ending such as .com may be left as it is.
Frequently asked questions
What does defanging a URL mean?
It changes a link so it can no longer be clicked or opened by mistake, for example https://evil.example becomes hxxps://evil[.]example. Security teams use it in reports and chats.
What is changed?
http becomes hxxp, dots become [.] and the @ in an email becomes [@]. Links, plain domains, IP addresses and emails are all handled.
Can I get the original back?
Yes. Refang turns hxxp back into http and [.] back into a dot. It also reads (.) and [dot].
Is my text uploaded?
No. The change is made in your browser. The links are never opened or contacted.
How do I use this defang / refang url tool?
Use the interactive controls above; processing stays in your browser and the result is intended as a practical starting point for development work.
More Security & Auth
JWT DecoderSee what is inside a login tokenEncode / DecodeTurn text into safe codes, and backHash GeneratorCreate a fingerprint of text or a filePassword GeneratorCreate strong passwords you can trustPassword Strength CheckerSee how strong your password really isCertificate DecoderRead what is inside an SSL certificateIBAN ValidatorCheck a bank account number (IBAN)CSP Header GeneratorBuild a security header for your website