Expand any shortened URL and see the full redirect chain, status codes, shortener service and a safety score - without clicking it. Free, no signup.
Paste a shortened link and see exactly where it goes before you click it. This URL expander follows the full redirect chain hop by hop, shows the HTTP status code, response time and server for each step, identifies the shortening service in use, decomposes the query string, and scores the final destination for the patterns that indicate a malicious link. You get the answer to the only question that matters — what is actually at the end of this — without your browser ever loading the page.
That distinction is the point. A shortened URL is deliberately opaque: bit.ly/3xQ2mK9 tells a recipient nothing, which is exactly why phishing campaigns, malvertising and smishing texts lean on shorteners so heavily. Expanding the link in a tool rather than in your browser means no JavaScript from the destination runs, no drive-by content loads, and no tracking pixel logs your visit.
j.mp, TinyURL, goo.gl, t.co, youtu.be, amzn.to, LinkedIn, Facebook, Pinterest, WhatsApp, Telegram, Hootsuite, Buffer, GitHub, is.gd, Rebrandly, cutt.ly, tiny.cc, Short.io, Spotify and more — each with a trust level and notes.Following redirects requires actually making HTTP requests, so this tool uses a server-side fetch rather than running purely in your browser. That is the whole benefit: the request comes from our infrastructure, not from your IP address or your browser fingerprint.
redirect is not.Every analysis starts at 100 and loses points for each risk factor found. The deductions are explicit:
| Risk factor | Deduction | Why it matters |
|---|---|---|
| Redirect loop detected | 30 | The chain returns to a URL it already visited — often a cloaking mechanism |
| Invalid final URL | 30 | The chain does not resolve to a parseable destination |
| HTTPS downgraded to HTTP | 25 | Traffic after that hop is unencrypted and modifiable in transit |
| Excessive redirects (more than 10 hops) | 20 | Long chains are used to defeat automated scanners |
| Possible fake login page | 20 | The path contains “login” but the host does not — a credential-harvesting shape |
| Final URL is a bare IP address | 15 | Legitimate services use domain names; IP hosts avoid domain reputation |
| 20-hop maximum reached | 15 | Analysis stopped early; the real destination may not be shown |
| Multiple redirects (6–10 hops) | 10 | Worth understanding, though affiliate networks legitimately chain |
| Suspicious TLD | 10 | .tk, .ml, .ga, .cf, .gq, .xyz, .top, .work, .click, .link, .loan, .download, .stream, .review, .country, .faith and .cricket appear disproportionately in phishing |
| Excessive subdomains (more than 4 labels) | 8 | A shape used to make a hostile host look like a familiar brand |
| Suspicious parameters | 5 each | Open-redirect parameter names, base64-looking values, or javascript: and <script content |
Treat the score as a prompt for attention, not a verdict. A legitimate marketing link routed through three trackers will score in the seventies; a well-built phishing page on a freshly registered .com with a clean chain can score in the nineties. The individual risk factors are more informative than the number.
The status code on each hop tells you what kind of redirect it is, and that matters when you are reasoning about SEO or about caching behaviour.
| Code | Meaning | Notes |
|---|---|---|
| 301 | Moved Permanently | Cached aggressively by browsers; passes link equity |
| 302 | Found (temporary) | The default for most link shorteners |
| 303 | See Other | Forces a GET on the next hop |
| 307 | Temporary Redirect | Preserves the original method and body |
| 308 | Permanent Redirect | Like 301 but method-preserving |
| 200 | OK | End of the chain — this is the real destination |
Two patterns in a chain deserve a second look. A hop that moves from https:// to http:// is a protocol downgrade, and everything after it is in the clear. And a chain that passes through a domain whose only job appears to be forwarding — especially one on a free TLD — is a redirector, which is the standard way phishing infrastructure survives takedowns of individual landing pages.
The parameter table separates two ideas. Tracking parameters — utm_source, utm_medium, utm_campaign, utm_term, utm_content, fbclid, gclid, msclkid, _ga, mc_cid, mc_eid — are ordinary analytics plumbing; they identify the campaign that sent you and, in the case of the click identifiers, can identify you individually across sites. Suspicious parameters are a different thing: names like redirect, return, next, url, continue, dest, goto, redir, out, link, to and target are the raw material of open-redirect abuse, where an attacker borrows a trusted domain to bounce a victim somewhere else. A long base64-looking value, or one containing javascript: or <script, is flagged for the same reason.
Copy the link rather than opening it, paste it here, and read the final destination from the chain. The request is made from our servers, so the destination never sees your IP address, your browser or your device.
Not definitively. It expands the chain and scores structural risk indicators; it does not download and detonate the destination or check it against threat-intelligence feeds. Use it to see where a link goes and to spot the obvious warning signs, then check the resolved domain with our domain risk scanner or IP risk checker before trusting it.
To stop runaway or deliberately unbounded chains. If the limit is reached the analysis says so and deducts points, so you know the shown destination may not be the last one.
Email platforms, affiliate networks and analytics vendors each insert a hop to record the click. Three to five hops on a newsletter link is routine. Ten or more is unusual outside of ad-tech.
A chain that returns to a URL it has already visited. Sometimes it is a misconfigured site; sometimes it is cloaking, where the destination behaves differently for scanners than for real visitors. Either way the tool detects it and reports the hop where the loop closed.
No — plenty of legitimate sites use them. They are flagged because abuse rates on cheap and free TLDs are far above the average, which makes them a useful prior, not a conclusion.
The shortener records a click against its own counter, as it would for any request. What it does not get is your IP address, user agent or referrer, because the request originates from our infrastructure.
Yes — the analysis produces a cleaned version of the final URL with the known tracking parameters stripped, which is what you want before sharing a link publicly.
Yes, as JSON or CSV, which is the usual requirement when a suspicious link becomes an incident ticket or a report to a security team.
For the SEO view of the same data, the redirect chain checker focuses on status codes and chain length. When a link arrives by email, the phishing email analyzer examines the headers and body around it, and the URL defanger makes a hostile URL safe to paste into a ticket or chat. To research the resolved domain itself, try the WHOIS lookup.
URL expansion (or URL unshortening) reveals the full destination URL behind a shortened link. URL shortening services like bit.ly, t.co, goo.gl, and tinyurl.com compress long URLs into brief links that are convenient for sharing but conceal the actual destination — a property frequently exploited by phishing campaigns, malware distributors, and social engineering attacks.
Expanding shortened URLs before clicking them is a fundamental security practice. By revealing the true destination, you can verify whether the link leads to a legitimate website or a malicious one before your browser makes the request.
URL shortening services maintain a database that maps short codes to full URLs:
| Short URL | Actual Destination | Visible to User? |
|---|---|---|
| bit.ly/3xK9mP2 | https://legitimate-bank.com/login | No — until expanded |
| bit.ly/4aB7cD3 | https://l3gitimate-bank.com/phishing | No — attack hidden |
| t.co/abc123 | https://malware-host.example.com/payload.exe | No — disguised download |
When clicked, the shortening service responds with an HTTP redirect (301 or 302) to the full URL. The user's browser follows the redirect automatically.
Shortened URLs hide the destination, enabling phishing attacks, malware distribution, and tracking. Attackers use legitimate shorteners (bit.ly, tinyurl) to bypass email filters and social media restrictions. Expanding reveals the true destination, allowing you to verify legitimacy before visiting. Check for suspicious domains, unexpected parameters, or mismatches between claimed and actual destinations to avoid threats.
URL shorteners create short aliases that redirect to longer URLs. When you visit a short URL, the service performs a 301/302 redirect to the target. Services track clicks, geography, referrers, and devices for analytics. Popular services: bit.ly, TinyURL, t.co (Twitter), goo.gl (deprecated). While convenient for sharing, shorteners create transparency issues and dependency on third-party services for link persistence.
Not automatically. While major shorteners (bit.ly, TinyURL) scan for malware, they can't detect all threats, and attackers constantly create new malicious sites. Shortened URLs are common in phishing because they hide destinations. Always expand before clicking, especially in emails, SMS, or social media from unknown sources. Look for warning signs: unexpected domains, Unicode tricks, typosquatting attempts.
Expanding reveals: final destination domain, path and parameters, redirect chains (multiple hops), HTTP status codes, whether HTTPS is used, potential tracking parameters (utm_source, etc.). Some expanders show page titles, reputation scores, or malware scan results. Analyze parameters for data being transmitted, check domain reputation, verify HTTPS certificates for sensitive transactions.
No. Expanders reveal destinations but can't detect all threats: zero-day exploits, time-delayed attacks (show legitimate content initially), geo-targeted attacks (show different content based on location), or sophisticated phishing using legitimate-looking domains. Combine expansion with URL reputation services, malware scanners, and security awareness. When in doubt, don't click—contact sender via alternative channel to verify.
Attackers use shorteners to: hide malicious domains from email/social media filters, bypass URL blacklists (shortener domain is legitimate), track victims (click analytics), enable rapid URL switching (change destination without changing short URL), and create urgency (short URLs look time-sensitive). Some shorteners allow custom aliases, enabling social engineering (bit.ly/company-invoice). Always verify before clicking shortened links in unexpected contexts.
Preview features fetch and display destination page content without full visit: page title, meta description, screenshot, SSL certificate info, reputation scores. This provides additional context for legitimacy assessment. However, preview requests still contact the server, potentially alerting attackers or triggering tracking. For highly suspicious links, use sandboxed environments or dedicated security services instead of direct preview.
Consider blocking unknown shorteners while allowing approved ones (bit.ly, t.co) in web filters. Blocking prevents shortened malicious links but may impact legitimate business communications and social media. Alternative approach: expand URLs at email gateway, show destinations to users, and scan expanded URLs for threats. Train users to recognize risks and verify unexpected shortened links through alternative channels before clicking.