Skip to content
TextArray1.41.0
100% local

URL defanger

Defang and refang URLs, IPs and emails so links can't be clicked.

Input
Output
Related tools
URL extractorDeveloper tools
URL validatorDeveloper tools
Domain extractorDeveloper tools
IP address extractorDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
URL defanger
The URL defanger turns live links into a safe, non-clickable form. It rewrites http://evil.com/path as hxxp[://]evil[.]com/path, so the address stays readable but no chat client, email program or terminal will turn it into a working link. This is the standard way analysts share indicators of compromise: a defanged URL can be pasted into a ticket, a report or a message without the risk that a colleague clicks it by accident.
Defanging replaces the parts that make a string auto-link. The dots in a domain or IPv4 address become [.], the scheme http and https become hxxp and hxxps, and the @ sign in an email address becomes [at]. Each of those three substitutions has its own toggle, so you can match whatever convention your team uses. Bare IP addresses like 8.8.8.8 are handled too — every dot is wrapped.
Refang mode does the exact reverse. Paste a defanged indicator from a threat feed or a report and get the original URL, IP or email back, ready to look up in your own tooling. The two directions are lossless inverses of each other when the same toggles are on.
Everything runs locally in your browser. The tool never fetches, resolves or visits any address you paste — it only rewrites the text — so even genuinely malicious URLs are completely inert here, and nothing you enter is uploaded anywhere.
FAQ
What does defanging a URL mean?
Defanging rewrites a URL so it is no longer a working, clickable link — for example http://evil.com becomes hxxp[://]evil[.]com. The address is still readable, but no app will auto-link or open it, which makes it safe to share malicious indicators in tickets and reports.
How do I refang a URL?
Switch the mode to Refang and paste the defanged text. The tool restores hxxp to http, [.] back to a dot and [at] back to @, giving you the original URL, IP or email address.
Can I defang IP addresses and email addresses too?
Yes. Dots in an IPv4 address like 8.8.8.8 are wrapped in brackets, and the @ in an email address is replaced with [at]. Each substitution has its own toggle so you can follow your team's convention.
Is it safe to paste a malicious URL here?
Yes. The tool only rewrites text — it never fetches, resolves or opens any address, and nothing you paste is uploaded anywhere. Everything runs entirely in your browser.