URL & IP Defanger and Refanger

Defang and refang URLs, domains, IP addresses and emails for safe IOC sharing — http becomes hxxp and every dot becomes [.], or reverse it. Free, no upload.

Neutralize indicators so they cannot be clicked or auto-linked when shared — http becomes hxxp and ftp becomes fxp.

🔒 Runs in your browser — nothing is uploaded.

What defanging a URL means

Defanging rewrites a dangerous URL, domain, IP address, or email into a form that cannot be clicked or auto-linked — http becomes hxxp, ftp becomes fxp, :// becomes [://], every dot becomes [.], and @ becomes [at]. Security teams defang indicators of compromise (IOCs) before pasting them into tickets, chat, wikis, or email so a colleague cannot accidentally open a malicious link. Refanging is the reverse: it turns a defanged indicator back into a working URL or IP for use in a sandbox or scanner.

Defang and refang in your browser

Paste a whole block of text and switch between Defang and Refang — every match in the block is converted at once, so many indicators can be processed together. Refang is tolerant of the styles other tools emit, including hxxp[:]//, fxp[://], [dot], (dot), (.), (at) and [@], so IOCs shared from any source are restored correctly. Everything runs locally in your browser and nothing is uploaded, which matters when the text is a live threat indicator.

Frequently asked questions

What is the difference between defang and refang?

Defang neutralizes an indicator so it cannot be clicked — for example http://evil.com becomes hxxp[://]evil[.]com. Refang does the reverse and restores the original URL or IP. Defang before sharing an indicator, and refang before submitting it to a scanner or sandbox.

Does it work on IP addresses and emails too?

Yes. Every dot is bracketed, so 8.8.8.8 becomes 8[.]8[.]8[.]8, and the @ sign becomes [at], so alert@example.com becomes alert[at]example[.]com. Refang reverses both.

Is my data uploaded anywhere?

No. All defanging and refanging happens entirely in your browser, and the text never leaves your device — safe for sensitive threat-intelligence indicators.