UTILS.
100% in-browser
🛡️

URL / IP Defanger & Refanger

Defang or refang URLs, domains, IPs, and emails (http→hxxp, .→[.], @→[at]) so malicious indicators can be shared safely without becoming clickable.

Enter text above to defang or refang.

About this tool

The URL / IP Defanger & Refanger neutralizes malicious indicators so they can be pasted into tickets, chat, and reports without turning into live, clickable links — and reverses the process when you need the real value back. Defanging follows the widely-used convention seen in CyberChef and phishing-analysis workflows: the scheme http becomes hxxp and https becomes hxxps, :// becomes [://], every dot becomes [.], and the @ in an email address becomes [at]. The result is unmistakable to a human but inert to link parsers, chat auto-linkers, and click-through scanners.

Everything is a deterministic string substitution done locally in your browser, so nothing you paste is uploaded — safe for handling real indicators of compromise. Input is processed as-is across every line, so you can defang a whole list of URLs, IP addresses, and emails at once. Refanging applies the inverse map: [.] (and common variants like (.) and [dot]) back to a dot, hxxp/hxxps back to http/https, [://] back to ://, and [at] back to @, restoring a value someone else defanged.

A transforms selector controls how much is changed: full applies scheme, dot, and @ rewriting; dots-only touches just the periods (handy when you want a readable domain that still won't resolve); scheme-only rewrites just the protocol. The same selector governs refanging so the two directions stay symmetric. Copy the transformed text with one click.

Frequently asked questions

What exactly does defanging change?
In full mode: http→hxxp and https→hxxps, ://→[://], every . →[.], and @ →[at] in emails. The characters that make a string auto-link are replaced with bracketed look-alikes, so evil.com/x becomes evil[.]com/x and won't be clickable.
What does refanging do?
It reverses the substitutions to recover the original indicator: [.]→., hxxp→http, [://]→://, [at]→@. It also accepts common alternate defang styles like (.) and [dot] so you can restore indicators others defanged in slightly different ways.
What do the transform options mean?
Full rewrites the scheme, dots, and @. Dots-only changes just the periods — useful for a still-readable but non-resolving domain. Scheme-only rewrites just http/https and ://. The same choice applies to refanging so both directions match.
Is it safe to paste real malicious URLs here?
Yes. All transformation is plain string replacement performed in your browser; nothing is sent anywhere and no request is made to the indicators themselves. The tool only rewrites text, so it never fetches or resolves anything you paste.

More tools