OneTaskBy Tim King · Updated
Link Unwrapper
Decode Outlook Safe Links, Proofpoint, Google and Facebook Redirects Without Visiting
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Link Unwrapper works
This link unwrapper shows where a wrapped or redirected link really goes. Paste links rewritten by email security filters, social networks or search engines and it decodes the real destination, removes tracking parameters and gives you a clean link, all without visiting any of them.
How the link unwrapper finds the real address
Many services rewrite links so a click passes through them first. Outlook Safe Links, Proofpoint URL Defense, Google search results, Facebook, Instagram, LinkedIn, Slack, Reddit and YouTube all do this. The real address is still inside the wrapper, usually in a parameter such as url, u or q, sometimes encoded or scrambled. Proofpoint, for example, swaps characters in its older format and uses a compressed format in its newer one.
The tool knows each of these formats and decodes them. It also looks for any parameter holding another full link, including ones encoded in base64, and repeats the process when links are wrapped more than once. Common tracking parameters such as utm_source, fbclid, gclid and mc_eid are then removed.
Short links from services such as bit.ly are different, because the destination is stored on the shortener's server and can only be found by asking it. This page makes no network requests, so for those it shows the preview address each service offers instead, which reveals the destination safely.
FAQ
Why not just click the link to see where it goes?
Clicking tells the sender you opened the message and loads whatever is at the other end. Unwrapping reads the destination from the link itself, so you can decide whether to visit before anything loads.
Is removing the wrapper safe at work?
The wrapper is how your mail filter checks the site at click time. Use this to inspect a link, then follow the original wrapped link if you decide to visit, so your organisation's protection still applies.
Can it expand bit.ly and other short links?
Not directly, because that needs a request to the shortener and this page sends none. It shows the preview address for each known shortener instead, such as adding a plus sign to the end of a bit.ly link.
Which tracking parameters are removed?
Campaign tags such as utm_source and utm_campaign, click IDs such as fbclid, gclid, msclkid and ttclid, and mail tracking IDs from Mailchimp and HubSpot. Parameters the destination page needs are kept.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Phishing URL Checker
Check a suspicious link for look-alike domains and phishing tricks.
URL Validator
Check a list of URLs for syntax errors, one per line.
Redirect Generator
Turn an old-to-new URL list into 301 rules for Apache, Nginx, Netlify and Vercel.
UTM Campaign URL Builder
Build correctly encoded UTM campaign links with consistent naming.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.