https://cybertoolchain.io/tools/unfurl New releases and features in Unfurl, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 04:06:06 GMT https://github.com/RyanDFIR/unfurl/releases/tag/v2026.11 https://github.com/RyanDFIR/unfurl/releases/tag/v2026.11 Thu, 29 Oct 2026 04:06:06 GMT Unfurl adds ETag, ChatGPT/OpenAI ID, and Firebase Push ID parsers for deeper URL forensic analysis⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Unfurl now parses ETags found in `etag` query parameters or quoted header values (`"..."` or `W/"..."`) and decodes layouts from Apache httpd, nginx, and Node.js, extracting file size, mtime (seconds, milliseconds, or microseconds), inode, and compression suffix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Unfurl now parses ChatGPT and OpenAI IDs embedded in URLs. • Unfurl now parses Firebase Push IDs embedded in URLs. • Unfurl now converts WebKit, WebKit milliseconds, Windows FileTime, and UUID v1/v6 timestamps with integer math instead of floating-point, preserving source precision (three digits for WebKit milliseconds, six for WebKit, seven for FileTime and UUID times). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/RyanDFIR/unfurl/releases/tag/v2026.09 https://github.com/RyanDFIR/unfurl/releases/tag/v2026.09 Wed, 16 Sep 2026 20:49:19 GMT Unfurl v2026.09 adds parsers for Gmail, Safe Links, Facebook, Instagram, GitHub, Fernet/itsdangerous tokens, defanged IOCs, and more, plus Tree/Text/dark-mode UI and a layered config system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `UNFURL_BITLY_API_KEY`, `UNFURL_VIRUSTOTAL_API_KEY`, and `UNFURL_GOOGLE_KG_API_KEY` environment variables for API key configuration, replacing the old bare lowercase names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `UNFURL_REMOTE_LOOKUPS` environment variable to enable or disable remote lookups from the environment, overriding both config files. • Adds `unfurl.local.ini` as a gitignored, user-local config overlay that overrides `unfurl.ini` without risking committed secrets. • Adds YAML-based site definitions system (see `unfurl/parsers/site_defs/README.md`) to teach Unfurl a site's URL structure without writing Python. • Adds Google `/aclk` ad click URL parsing with parameters `adurl`, `ai`, `gclid`, `sig`, and more via `google.yaml`. • New parser for Gmail legacy hex and new-style (2018+) URL tokens, decoding to Gmail IDs and embedded timestamps; handles `th`, `compose`, `permmsgid`, `permthid`, and `projector`. • New parser for Microsoft Defender Safe Links, extracting the wrapped destination URL and pipe-delimited `data` field (format versions 01 through 05): recipient, message and tenant GUIDs, timestamp, scan verdict, and scan payload. • New parser for Facebook URL paths (posts, photos, videos, groups, events, stories, pages, Marketplace, profiles, comments) and decoding of modern `fbclid` values (browser ID, app ID, ad ID, AEM hash). • New parser for Instagram posts, reels, stories, highlights, and profiles, with shortcodes and story IDs decoded to creation timestamp, shard ID, and sequence number. • New parser for GitHub URLs covering repos, commits, issues, PRs, branches, releases, Actions runs, compare views, OAuth flows, and line-number fragments. • New parser for Fernet tokens extracting version, cleartext creation timestamp, IV, ciphertext, and HMAC; includes the re-padded form used by ChatGPT Ads click IDs (`oppref`, `olref`). • New parser for `itsdangerous` signed tokens (used by Flask and other Python web apps), extracting payload (decompressed if needed), signing timestamp, and signature. • New parser for MongoDB ObjectIDs and their embedded timestamps. • New parsers for Base32 and Base58 encoding. • New parser for defanged indicators (e.g. `hxxps://evil[.]com/payload[.]exe`, `1.2.3[.]4`, `user[at]evil.com`), refanging them into a new node with a hover listing every replacement made. • New parser for file extensions, identifying file type and flagging extensions commonly abused to deliver malware. • Parses Text Fragments (`#:~:text=`) and SPA-style fragment routes (`#/route?key=value`). • Parses `;`-delimited `key=value` pairs in URLs, as used by ad servers and path parameters. • Adds UUID version 6, 7, and 8 support, with timestamps extracted from v6 and v7. • Adds new timestamp formats: WebKit milliseconds, Epoch nanoseconds, PostgreSQL, and Mac Absolute Time nanoseconds. • Adds Bing `form` code parsing (including indexed variants) and image search parameters (`thid`, `mediaurl`, `sbifnm`, `iss`, `view`, and more). • Adds 40 more shortener domains including `aka.ms`, `flic.kr`, `redd.it`, `pin.it`, `t.cn`, and `wa.link`, plus Constant Contact click-tracking links. • Adds Tree and Text views alongside the Graph in the web UI, with copy-to-clipboard for the text tree. • Adds dark mode to the web UI, with user preference remembered. • Tests now ship with the package, enabling validation of an installed copy with `python -m unittest discover -s unfurl.tests.unit`. • Layered configuration now reads `unfurl.ini`, then `unfurl.local.ini`, then `UNFURL_*` environment variables, then CLI flags, with each layer overriding the last. • Epoch seconds auto-detection now covers 2010 onward (previously 2015). • Discord snowflakes created after July 2022 are now decoded in general Discord URL paths, and snowflakes in query values and token payloads on Discord domains are decoded. Breaking changes: • The old bare lowercase API key environment variable names (`bitly`, `virustotal`, `google_kg`) are deprecated and log a warning — rename them to `UNFURL_BITLY_API_KEY`, `UNFURL_VIRUSTOTAL_API_KEY`, and `UNFURL_GOOGLE_KG_API_KEY`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04 https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04 Sun, 05 Apr 2026 15:38:43 GMT Unfurl v2026.04 adds `stash`, `proto`, Google Knowledge Graph parser, and JSON list support • Allows JSON inputs to be parsed directly as top-level lists (arrays) without wrapping objects Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2025.08 https://github.com/obsidianforensics/unfurl/releases/tag/v2025.08 Sun, 10 Aug 2025 23:28:48 GMT Unfurl v2025.08 adds TikTok ID parsing with milliseconds/sequence and epoch timestamp utility • Adds `datetime.UTC` as tzinfo for timestamp nodes • Update TikTok ID parsing to include milliseconds, sequence, entity type, and machine ID • Add utility function to create epoch timestamps for a date Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2025.03 https://github.com/obsidianforensics/unfurl/releases/tag/v2025.03 Wed, 12 Mar 2025 21:07:03 GMT Unfurl v2025.03 adds parsing for Mastodon instances (truthsocial.com, gab.com), Google `udm` parameter, and raises timestamp ceiling to 2030 • Add parsing of Mastodon usernames and RSS URLs; add `truthsocial.com` and `gab.com` to the Mastodon parser • Google updates - add parsing of `udm` parameter and modify "two-parent" nodes • Increase maximum "reasonable" timestamp to 2030 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2025.02 https://github.com/obsidianforensics/unfurl/releases/tag/v2025.02 Tue, 18 Feb 2025 16:49:12 GMT Unfurl v2025.02 adds Bluesky DID lookup and IP address parsing in hostnames • Adds `--bsky-did` flag to resolve a Bluesky handle to its DID and fetch the DID creation timestamp from the audit log. • Adds `--parse-ip-in-hostname` option to detect and extract embedded IPv4 addresses from hostname strings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2024.11 https://github.com/obsidianforensics/unfurl/releases/tag/v2024.11 Thu, 21 Nov 2024 18:06:12 GMT Adds Bluesky TID parser and tightens b64+proto parsing filters • Adds a dedicated parser for Bluesky TIDs (timestamp ids) • Tightens b64+proto parsing to filter out entries containing all digits or all number paths • Adds support for `x.com` domains in the Twitter parser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2023.09.05 https://github.com/obsidianforensics/unfurl/releases/tag/v2023.09.05 Sun, 17 Sep 2023 23:36:37 GMT Adds `parse_jwt.py` for JWT parsing and DNS DoH URL parser to Unfurl v2023.09.05 • `parse_jwt.py` added to parse JSON Web Tokens with supporting functions • Parser added for DNS DoH URLs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2022.11 https://github.com/obsidianforensics/unfurl/releases/tag/v2022.11 Mon, 07 Nov 2022 23:35:54 GMT Unfurl v2022.11 adds LinkedIn profile parsing, Substack expansion and `run`/`print_tree` functions. • Add expansion of Substack redirects to link shortening parser. • `run` • Add parsing of LinkedIn URLs: Messages (v1 and v2), Profile IDs, and … • Use flask-restx for the API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl https://github.com/obsidianforensics/unfurl/releases/tag/v2022.02 https://github.com/obsidianforensics/unfurl/releases/tag/v2022.02 Thu, 10 Feb 2022 00:44:36 GMT Unfurl v2022.02 adds parsers for Brave Search and Google "aqs", MISP enrichment, Twitter snowflake decoding, multi-parent nodes, and LinkedIn shortener lookups. • Adds parser for Brave Search • Add parsing for Google Search "aqs" parameter • Use MISP "warning lists" to enrich domain names • Add MISP's list of URL shortener domains to parse_shortlink.py • Decode snowflake IDs from Twitter image attachment names • Adds support for nodes to have multiple parents • Add URL redirect lookup for another type of Linkedin link shortener Full history on Cyber Toolchain: https://cybertoolchain.io/tools/unfurl