Security · 58 tools · nothing uploads

Defang / Fang URL

Defang / Fang URL. Defang turns a live indicator into inert text (won't render as a link); fang reverses it. Pure text substitution, on your device.

Input

Options

live

Defang / Fang URL rewrites an indicator into text a mail or chat client will not linkify: http turns into hxxp, :// into [://], and each period into [.]. Setting mode to fang puts all three back. Substitution runs over the whole file, so periods in ordinary sentences and version numbers are rewritten as well.

Questions

What does defanging change?

Three substitutions across the whole text. The scheme becomes hxxp or hxxps, the :// becomes [://], and every period becomes [.]. The result will not render as a clickable link in a ticket, a chat message or an email client, which is the point.

Can I get the original back?

Yes, switch mode to fang. It reverses all three substitutions, turning hxxp back into http, [://] back into ://, and [.] back into a period. Round tripping ordinary text works, though anything you had written with literal square brackets around a period will come back changed.

Does it only touch URLs?

No, and this matters. The substitutions run over the entire file text, so every period in the document becomes [.], including the ones in sentences and version numbers. Feed it the indicators you want defanged, not a whole report, unless you want the whole thing rewritten.

Why does my defanged text still look clickable?

Some chat and mail clients linkify a bare domain even without a scheme. Defanging removes the shape those clients usually match, but no text transformation can promise every client will refuse. Check how it renders where you plan to send it.

Is this the same as the IP defanger?

Close, but not the same rules. Defang / Fang IP replaces every period with [.] and every colon with [:], for IPv4 and IPv6, and does nothing to a URL scheme. Running it on a URL would turn the scheme colon into [:] as well.

Compare

ToolRuns on the CLILive as you type
Defang / Fang URLYesYes
IOC extractorYesYes
Defang / Fang IPYesYes
JA3 / JA3S fingerprintYesNo
HASSH fingerprint (SSH)YesNo

Related Security tools

n→nIOC extractorPull URLs, IPs, domains, emails, hashes, MAC addresses, file paths and dates out of text in one pass, understanding defanged forms (hxxp, [.]/(.)/{.}, [://], [:], [@]) as well as live ones. Regex-based pattern matching, not a validator: a matched hash might be any 64 hex characters, not necessarily a real SHA-256 of anything, and "domain" filters out a small blocklist of common file extensions (.php/.exe/.sh/...) rather than knowing real TLDs. Categories can overlap by design (a domain inside a matched URL is listed under both).Runs on each file you dropn→nDefang / Fang IPDefang / Fang IP. Defang turns a live indicator into inert text (won't render as a link); fang reverses it. Pure text substitution.Runs on each file you dropn→nJA3 / JA3S fingerprintCompute the JA3 (ClientHello) or JA3S (ServerHello) TLS fingerprint from a raw captured TLS record. JA4 is not implemented. See the tool source for why. A matching fingerprint means two handshakes look alike, not that either endpoint is safe or malicious.Runs on each file you dropn→nHASSH fingerprint (SSH)Compute the HASSH fingerprint from a raw SSH KEXINIT packet. Best-effort recollection of the published field composition (kex;encryption_c2s;mac_c2s;compression_c2s, MD5), NOT checked against the reference hassh tool's output (no network access to verify). The KEXINIT wire parsing itself is plain RFC 4253. A matching fingerprint means two handshakes announced the same algorithms, nothing about trust.Runs on each file you drop