About this tool
The URL / IP Defanger & Refanger neutralizes malicious indicators so they can be pasted into tickets, chat, and reports without turning into live, clickable links — and reverses the process when you need the real value back. Defanging follows the widely-used convention seen in CyberChef and phishing-analysis workflows: the scheme http becomes hxxp and https becomes hxxps, :// becomes [://], every dot becomes [.], and the @ in an email address becomes [at]. The result is unmistakable to a human but inert to link parsers, chat auto-linkers, and click-through scanners.
Everything is a deterministic string substitution done locally in your browser, so nothing you paste is uploaded — safe for handling real indicators of compromise. Input is processed as-is across every line, so you can defang a whole list of URLs, IP addresses, and emails at once. Refanging applies the inverse map: [.] (and common variants like (.) and [dot]) back to a dot, hxxp/hxxps back to http/https, [://] back to ://, and [at] back to @, restoring a value someone else defanged.
A transforms selector controls how much is changed: full applies scheme, dot, and @ rewriting; dots-only touches just the periods (handy when you want a readable domain that still won't resolve); scheme-only rewrites just the protocol. The same selector governs refanging so the two directions stay symmetric. Copy the transformed text with one click.