URL & IP Defanger and Refanger
Defang and refang URLs, domains, IP addresses and emails for safe IOC sharing — http becomes hxxp and every dot becomes [.], or reverse it. Free, no upload.
Neutralize indicators so they cannot be clicked or auto-linked when shared — http becomes hxxp and ftp becomes fxp.
🔒 Runs in your browser — nothing is uploaded.
What defanging a URL means
Defanging rewrites a dangerous URL, domain, IP address, or email into a form that cannot be clicked or auto-linked — http becomes hxxp, ftp becomes fxp, :// becomes [://], every dot becomes [.], and @ becomes [at]. Security teams defang indicators of compromise (IOCs) before pasting them into tickets, chat, wikis, or email so a colleague cannot accidentally open a malicious link. Refanging is the reverse: it turns a defanged indicator back into a working URL or IP for use in a sandbox or scanner.
Defang and refang in your browser
Paste a whole block of text and switch between Defang and Refang — every match in the block is converted at once, so many indicators can be processed together. Refang is tolerant of the styles other tools emit, including hxxp[:]//, fxp[://], [dot], (dot), (.), (at) and [@], so IOCs shared from any source are restored correctly. Everything runs locally in your browser and nothing is uploaded, which matters when the text is a live threat indicator.
Frequently asked questions
What is the difference between defang and refang?
Defang neutralizes an indicator so it cannot be clicked — for example http://evil.com becomes hxxp[://]evil[.]com. Refang does the reverse and restores the original URL or IP. Defang before sharing an indicator, and refang before submitting it to a scanner or sandbox.
Does it work on IP addresses and emails too?
Yes. Every dot is bracketed, so 8.8.8.8 becomes 8[.]8[.]8[.]8, and the @ sign becomes [at], so alert@example.com becomes alert[at]example[.]com. Refang reverses both.
Is my data uploaded anywhere?
No. All defanging and refanging happens entirely in your browser, and the text never leaves your device — safe for sensitive threat-intelligence indicators.