Obfuscated URL decoder
A phishing link is designed to survive a glance. http://www.paypal.com@3232235777/login contains a real domain, an @, and a number that is an IP address — and it goes nowhere near PayPal. Paste a link to see the host a browser will actually connect to, with each disguise technique named. Nothing is fetched: the URL is only decoded.
What the browser sees
Techniques detected
How to use
- Paste the link. Do not click it — and note that this tool never requests it, so pasting is safe.
- Read Real host in the first table. That is the only line that matters: it is where the connection goes.
- Techniques detected names each disguise and explains it, ranked high, medium or low confidence.
- The Canonical form box gives you the de-obfuscated URL, safe to quote in an incident note.
The techniques, and why they work
Userinfo before the host. http://[email protected]/ is a URL with the username trusted.com and the host evil.test. The syntax is legitimate — it dates from FTP-style credentials in URLs — and browsers still honour it. Since the trusted name appears first and the real host is at the end, it reads correctly to anyone scanning left to right.
Numeric host encodings. A browser accepts an IPv4 address as a single 32-bit integer (3232235777), in hex (0xC0A80101), in dotted octal (0300.0250.01.01), or in any mixture of those. All resolve to the same address. This defeats any filter matching on dotted-decimal notation, and looks like a tracking ID to a human.
Backslashes. Browsers normalise \ to / in URLs, so http:/\evil.test works. Validation code that splits on / does not, which is why this appears in redirect-filter bypasses as well as in phishing.
Invisible characters. Zero-width spaces, zero-width joiners and bidirectional-override characters can be placed inside a hostname or a path. They do not render, so two visually identical URLs can be different strings — and a bidi override can make a URL display right-to-left, showing a different apparent domain from the one that will be requested.
Punycode homographs. xn--pypal-4ve.com displays as pаypal.com with a Cyrillic а. Browsers show the Unicode form when the script is consistent, which is precisely when the attack works. The homograph checker analyses the mixed-script rules in detail.
Subdomain padding. login.secure.paypal.com.verify-account.evil.test puts the brand where a phone's address bar truncates. The registrable domain is always the last two labels before the TLD, never the first ones.
Non-navigational schemes. data:text/html;base64,… renders attacker-controlled HTML with the URL bar showing something opaque; javascript: executes in whatever origin it is triggered from. Neither fetches a page in the way the URL implies.
What this tool cannot tell you
It decodes structure; it does not judge intent, and it makes no network request. A URL with no obfuscation can still be hostile — a plain, honest https:// link to a newly registered domain is the most common phishing URL there is, and there is nothing in its syntax to detect. Equally, some legitimate systems use @ or unusual hosts.
A shortened URL cannot be resolved here at all: expanding one requires a request, which is the one thing a client-side tool cannot do cross-origin. The tool flags known shorteners so you know that the destination is unknown rather than absent.
For a verdict on whether a destination is malicious, use a reputation service — VirusTotal, urlscan.io, or Google Safe Browsing. Use this first, so you know which host to look up.
FAQ
Is it safe to paste a live phishing URL here?
Yes. It is treated as text: nothing is fetched, no request is made, and no script from the URL runs. The Network panel stays empty while you use the tool.
Why does my browser show a different host from the one in the link?
That is usually the point of the link. The address bar shows the host the browser resolved after applying all of the rules above; the visible text of the link was written to look like something else. The "Real host" row here matches what your browser will do.
Where did the number come from in 3232235777?
It is 192.168.1.1 written as one integer: 192×256³ + 168×256² + 1×256 + 1. The tool shows the conversion so you can check it.
Can it check a whole list?
This one takes a single URL, because the output is a detailed explanation. For bulk work, run the list through the typosquat checker against your brand and the privacy audit, both of which take lists.