Defang / Refang

Paste a block of text — an alert, a ticket, a report — and defang every URL, domain, IP, and email address in it so it's safe to drop into Slack, email, or a ticket without becoming a live, clickable link. Refang reverses it. Everything else in the text is left exactly as written. Runs entirely in your browser; nothing you paste is sent anywhere.

Heads up: refanged URLs and domains become real, clickable links again — don't refang text you're about to paste somewhere those could be auto-linked or clicked by accident.

What gets recognized

Defang recognizes URLs (http:///https:// → hxxp:///hxxps://), domains, bare IPv4 addresses, and email addresses, and brackets their dots (evil.example → evil[.]example) and, for email, the @ (→ [@]). Domains are only recognized against a curated list of common TLDs plus the four names RFC 2606 reserves for documentation (.example, .test, .invalid, .localhost — the placeholder domains SOC write-ups use instead of real ones) — this deliberately avoids bracketing ordinary sentence punctuation, version numbers (v10.2.5.100), and common abbreviations (e.g., etc.). IPv6 addresses are left untouched rather than risk corrupting them, except for the embedded IPv4 tail of a mapped address like ::ffff:192.168.1.1.

Refang recognizes every common defanged form: hxxp/hxxps, [.], (.), {.}, [:], [://], and [@].

Known limitation: a dotted word that happens to end in a real TLD but isn't actually a domain (Node.js is the classic case — .js is a real country-code TLD) can't be told apart from an actual domain by shape alone, so it may get bracketed. Nothing here claims to be perfect — when in doubt, check the output before pasting it somewhere that matters.