Analyst tool
Defang and refang indicators
Rewrite indicators so no software treats them as links and no reader clicks one by reflex — or convert the notation back into the value your own tools expect.
Nothing you paste leaves your browser. Open your network tab and check.
Live text in, defanged text out. Dots become [.], http becomes hxxp, @ becomes [at].
0 lines · 0 changed
Paste indicators on the left. Nothing you paste leaves this page — no upload, no logging, no storage.
What refang mode reads
Defanging is a convention, not a standard, and every vendor writes a slightly different dialect. Refang reads all of these; defang writes one house style — [.], hxxp, [://] and [at].
- [.] (.) {.} [dot] (dot) dot \.
- a dot
- hxxp hxxps hXXp h**p
- http / https
- httpx
- http only — never https
- [://] [:] [/]
- the scheme separator
- [at] (at) [@] at
- an at sign
- zero-width and non-breaking characters
- nothing — stripped
Why refang mode has no copy button
ClickFix is a paste attack, so anything shortening the distance between reading a string and pasting it works for the attacker. Refang output is live text and never has a copy button. Defang output usually does — but not always: defanging rewrites hostnames and email addresses, and a pasted PowerShell one-liner has neither, so it survives the conversion unchanged. The button is withheld whenever the output still looks like something that would run. That is enforced in the code, not in this paragraph.