How to use the URL Defang Refang Tool
- 1. Paste the textAdd links, domains, IPs or emails, one per line or inside text.
- 2. Choose defang or refangDefang to share safely, refang to use in a sandbox or blocklist.
- 3. CopyPaste the safe version into your ticket, chat or report.
What defanging changes
Email clients, chat apps and document editors turn anything that looks like a link into a clickable one. In a security report, that is how someone accidentally opens a phishing page. Defanging breaks the pattern while keeping the indicator readable: http becomes hxxp, dots in the host become [.], and @ in an email becomes [@].
Worked example: https://evil.example.com/login.php becomes hxxps://evil[.]example[.]com/login.php. The path is left alone because it is harmless once the host is broken. 198.51.100.7 becomes 198[.]51[.]100[.]7.
Refanging and conventions
Refang mode reverses the common styles: hxxp and hXXp, [.] and (.) and {.}, [dot], [:], [@] and [at]. Use it when you need live values, for example in a sandbox, a threat intelligence platform or a firewall blocklist, and never in an email or chat where the link could be clicked.
- Defang by default in tickets, Slack, Teams and email.
- Be consistent within a team; most tools understand hxxp and [.].
- Check the result: unusual top-level domains on their own (without http) may not be detected; include the scheme when you can.
This tool only rewrites text; it never visits any link. Extract every indicator from a long report in one go with the IOC extractor, and check where a suspicious email really came from with the email header analyzer.
Frequently asked questions
Why not just put links in quotes?
Many apps still auto-link text inside quotes. Defanging reliably stops that.
Is a defanged link safe to click?
It cannot be clicked as a link, which is the point. Never refang and open a malicious link outside an isolated sandbox.
Is the URL Defang Refang Tool free?
Yes, the URL Defang Refang Tool is free. The first time you see your first result, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.