IOC Defang and Refang Tool

Defang indicators so they are safe to paste into a ticket or email, or refang them back for tooling, in bulk and without touching the surrounding text.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Direction Defang - make indicators safe to paste Refang - restore them for tooling

Defanging style

Text

Why indicators get defanged at all

A malicious URL written normally in a document is a malicious URL that something will click. Email clients linkify it. Chat applications fetch a preview - which contacts the attacker's server from your network and tells them the report is circulating. Ticketing systems turn it into an anchor tag. Security scanners quarantine the whole message.

Defanging breaks the syntax just enough that no software recognises it as a link, while a human reads it perfectly well. hxxps://evil[.]com is unmistakable and completely inert.

Sentence full stops survive

This is the detail that separates a usable defanger from an annoying one. Replacing every dot in a paragraph produces text nobody can read. Only dots inside something that looks like a hostname or an IP address are converted, so prose stays prose.

The round trip is checked, not assumed

After defanging, the output is refanged again and compared against what you supplied. If the two do not match exactly, the result says so - usually because the input already contained some defanged notation, but occasionally because something genuinely did not survive. Either way you find out before pasting it into a report, rather than afterwards.

Three styles, because teams disagree

There is no standard. Brackets are the most common, parentheses are widespread, and spelled-out [dot] is required by some ticketing systems that strip brackets. Refanging accepts all of them plus several variants, so pasting from any source works regardless of which convention the author used.

Instant and local

Conversion happens as you type, in the page. Nothing is transmitted - which matters, because the text being defanged is usually an incident report that has not been published yet.

Frequently asked questions

Which style should I use?

Brackets unless something downstream requires otherwise. It is the most widely recognised and the least likely to be mangled by whatever the text passes through.

Is defanging a security control?

No. It stops accidental clicks and automatic link previews. It does not make a malicious indicator safe, and anyone who refangs it gets the original back - which is the point.

Why did refanging change my text slightly?

Refanging converts every defanged form it recognises, so text that used two conventions comes back consistently in one. The indicators are correct; the notation is normalised.

Does it handle IPv6?

Refanging does. Defanging targets dots and URL schemes, so an IPv6 address written with colons passes through unchanged - it is not linkified by most software anyway.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.