A shortened link hides its destination completely. Here is how to expand one before you click, what the expanded URL does and does not tell you, and which checks are worth running when the answer matters.

A message arrives with a link like this:

bit.ly/3xK9mQr

There is nothing in it to judge: no domain, no path, no clue about what sits on the other side. You either click and find out, or you do not click and never know.

That is the entire design of a link shortener, and it is why the same tool serves a marketing team tracking campaign clicks and someone sending a link they would rather you did not inspect.

What a Shortener Actually Does

A short link is not a different kind of address. It is an ordinary URL pointing at a redirect service. When you request it, that service looks up the code, returns a redirect response with a Location header, and your browser follows it to the real destination.

The whole exchange takes one round trip. Because browsers follow redirects silently and show only the final address, the intermediate step is invisible unless you look for it.

Expanding a short link means making that first request without following it — reading the Location header and stopping there. Our URL unshortener does exactly that: it asks the shortener where the link points and shows you the answer without loading the destination.

Why Short Links Hide More Than You Expect

Three things make them harder to reason about than a normal URL.

The domain tells you nothing. bit.ly, tinyurl.com, and t.co are used by millions of legitimate senders. The reputation of the shortener says nothing about the reputation of any individual link passing through it.

One short link can chain into several. Shorteners can point at other shorteners. A single bit.ly code may pass through two or three services before landing, and each hop is an opportunity to change the destination later.

The destination can change after the link is sent. Most shortening services let the owner edit where a code points. A link that resolved somewhere harmless last week can resolve somewhere else today, with the same short URL in circulation the entire time. This is the part people most often miss — the link you checked is not necessarily the link someone else clicks tomorrow.

Expanding a Link, Step by Step

For a quick look, paste the short URL into the unshortener and read the destination.

When the answer matters more than that, three further checks are worth the extra minute:

See the whole chain, not just the end. A destination reached through four hops is a different proposition from one reached directly. The redirect checker shows every hop with its status code, so chained shorteners become visible rather than collapsing into a single final address. It also shows whether each hop is a 301 or a 302 — a temporary redirect on a link that is supposed to be permanent is at least worth noticing.

Check how old the destination domain is. This is the single most useful signal in the whole exercise. Run the final domain through the WHOIS lookup and read the registration date. A domain claiming to be an established bank, retailer, or courier service, registered three weeks ago, has told you everything you need to know.

Read the response headers. If the expanded URL still does not explain the behaviour, the HTTP headers parser shows the raw Location value and any caching applied to the redirect. Our guide to reading response headers covers what the rest of them mean.

Decoding Before You Read

Campaign and tracking links often arrive heavily encoded, with the real destination sitting inside a query parameter:

https://click.example.com/r?u=https%3A%2F%2Fdestination.com%2Foffer%3Fid%3D42

That %3A%2F%2F is an encoded://. The URL decoder converts it back to something readable, which matters because a destination buried in percent-encoding is effectively hidden at a glance. Our guide to percent-encoding explains what each sequence means.

Encoding is not deception by itself — it is required for URLs carrying other URLs as parameters. But it does look unreadable at a glance, and that works the same way whether or not anyone intended it to.

What Expanding a Link Does Not Tell You

This is the part most articles on the subject skip, and it is the part that matters.

It does not tell you the destination is safe. Expanding shows you an address. A legitimate-looking domain can host a compromised page, and a domain can be compromised after you check it. This is a research step, not a verdict.

It does not reproduce personalised behaviour. Some redirect services route by location, device, or referrer. A link that resolves to a harmless page for a server in one country may resolve elsewhere for a phone in another. What you see is the answer given to this request, from this location, right now.

It does not follow JavaScript or meta refresh redirects. If the shortener returns a 200 and the browser still moves, the redirect is happening inside the page rather than in an HTTP header. Our tools trace HTTP redirects only.

It does not check reputation. There is no blocklist behind this. Use a dedicated security service if you need an actual safety assessment, and treat the expanded URL as one input to your own judgement rather than a substitute for it.

When the Link Is Your Own

The same checks are worth running on links you send.

Campaign links that pass through a shortener, then a tracking domain, then your site's HTTPS and www rules, can accumulate four or five hops before the page loads. Every hop is a round trip, and on a mobile connection that is measurable. Expanding your own links and counting the hops is a quick way to find redirects nobody meant to stack, which is the same problem that shows up after site migrations.

Frequently Asked Questions

Can I see where a short link goes without clicking it?

 Yes. Expanding the link requests it without following the redirect, so the destination is revealed without loading the page. That is what the unshortener does.

Does expanding a link count as a click?

 Usually yes. Most shorteners count the request itself, so the click statistic increments even though no page loaded. This matters if you are testing your own campaign links — your own checks will appear in the numbers.

Can a short link change where it points?

 Yes, on most services. The owner can edit the destination at any time, and the short URL stays the same. A link that was safe when you checked it can point somewhere else later.

Is a shortened link from a known service safe?

 The service says nothing about the link. Reputable shorteners carry both legitimate marketing links and malicious ones, because anyone can create a code. Judge the destination, not the shortener.

Why do some short links go through several redirects?

 Either a shortener pointing at another shortener, or a tracking layer sitting between the short link and the final page. Both are common in advertising, and both are visible in the redirect checker.

What should make me suspicious?

 A destination domain registered very recently while claiming to be an established brand, a chain of three or more shorteners with no obvious reason, or a final URL whose domain does not match the organisation the message claims to be from.

The Short Version

A short link is a redirect, and a redirect can be read without being followed. Expand it, check how old the destination domain is, and look at the whole chain rather than just the endpoint.

What you get is information, not a safety rating. Shortened links can be edited after they are sent, and a clean-looking domain can still host something you did not want — so treat the expanded URL as the start of a judgement, not the end of one.

Written by Baleeghuddin Shaikh, SEO consultant with 8 years of experience in technical SEO and site diagnostics.