The Defang / Refang tool is 100% client-side. The conversions are plain text substitutions performed in JavaScript on your device, with no backend, API, upload or CDN in the processing path and no analytics. This matters because the indicators an analyst handles — internal hostnames, victim domains, attacker infrastructure, email addresses — can be sensitive, and an online converter would receive all of them. Here nothing is persisted, the tool works offline once cached, and closing the tab erases everything. The only optional network use anywhere on the site is consent-gated ads, which never see your text.

Defanging is a formatting convention, not encryption or sanitisation. Rewriting hxxp[://]evil[.]com prevents a chat app, mail client or scanner from turning the text into a live, clickable, auto-fetched link, which is the whole point when you paste indicators into a report or ticket. But it does nothing to the underlying URL, IP or file — refang it and it works again, pointing at the same attacker-controlled infrastructure. Treat every refanged indicator as live and dangerous: restore it only inside an isolated analysis environment (a sandboxed or air-gapped VM, a throwaway browser profile, ideally behind a VPN or Tor), copy rather than click, and verify before acting. Some PDF viewers and rich editors may even re-link a defanged URL, so defanging reduces risk rather than removing it.

Because teams and tools defang differently, the refanger accepts a wide range of styles in one pass. It reverses the scheme obfuscations hxxp, hXXp, h**p and fxp; the dot variants [.], (.), {.} and the literal words [dot] / (dot); the separator forms [://], (://) and the bracketed colon; the at-sign forms [@], (@), [at] and (at); and backslash escapes before a dot, at-sign or slash. Whitespace inside the brackets is tolerated. This lets you normalise messy indicators pasted from different sources, and the one-tap Swap button round-trips between defang and refang.

Defanging grew as a community convention rather than a formal specification, so small differences exist — some teams bracket the :// separator, others only the dots; some escape every dot, others only host and IP dots. The most widely recognised form (http→hxxp, host/IP dot→[.], @→[@]) is used by CISA, the SANS Internet Storm Center and countless vendor reports, is implemented by CyberChef and ioc-fanger, and is codified in the IETF draft “A Standard for Safe and Reversible Sharing of Malicious URLs and Indicators”. This tool follows that convention and lets you choose bracket variants and dot scope, so agree on one style within your team and refang liberally.