How to use
01
Paste the short link
Paste the link into the Short URL field, for example https://bit.ly/abc123. A link without https:// works too. Copy it from the message without opening it first.
02
Press Expand
Our server follows each redirect and shows the final destination and number of redirects. Safety hints and the destination's title and description load just below.
03
Check the chain and copy
Read the hints and the chain hop by hop. Copy the final URL or the clean link without tracking. For many links, switch to Bulk and download the CSV.
Why URL Expander
- See where a bit.ly, t.co, TinyURL or other short link goes before you open it, with every redirect hop and status code.
- Safety hints: HTTPS, domain age, punycode look-alikes, bare IPs and stacked shorteners.
- Shows the destination title and description, and spots meta refresh and JavaScript redirects.
- Gives a clean link with utm and click-ID tracking removed. Bulk mode expands 20 links with CSV export.
Short link services the expander handles
These are common shorteners and what their links look like. All of them use HTTP redirects, so the expander can follow them. Brand shorteners, such as a newspaper's own short domain, usually work the same way. X wraps every link in t.co even when the original was already short, so a tweeted bit.ly link shows two redirects before the real page.
| Service | Link looks like | Used by |
|---|---|---|
| Bitly | bit.ly/3AbCdEf | Marketers, news sites, most social posts |
| X (Twitter) | t.co/AbCd123 | Every link posted on X is wrapped in t.co |
| TinyURL | tinyurl.com/abc123 | General use, often in forums and email |
| lnkd.in/eAbCd12 | Links in LinkedIn posts and messages | |
| Hootsuite | ow.ly/AbCd12 | Scheduled social posts |
| Buffer | buff.ly/AbCd12 | Scheduled social posts |
| Rebrandly | rebrand.ly/abc | Branded links on custom domains |
| is.gd | is.gd/AbCd12 | Quick anonymous shortening |
How to spot a phishing short link
Scammers use short links because they hide the real domain. Expand any link you did not expect, then look for these signs before you open it. The safety hints flag several of them for you.
- The final domain does not match the brand in the message, such as a bank link ending on a free hosting site or an odd spelling of the bank's name.
- The chain passes through several unrelated domains before it lands.
- The destination is a login or payment page, and the message pushed you to act quickly.
- The final URL uses plain http, or a long string of random words and numbers as the domain.
- The page title does not match what the message promised.
- When in doubt, do not click. Go to the company's site by typing its address yourself.
Common questions
How does the URL expander show where a link goes without me visiting it?
Our server requests the short link and reads the redirect it returns, then follows each redirect in turn. The destination page is also fetched by our server to read its title. Your browser never loads the page, so nothing on it can run on your device.
Can the URL expander follow chains with several redirects?
Yes, up to 10 hops. Each one is listed with its status code, which shows when a link bounces through a tracking service or an ad network before it arrives. If a chain is still redirecting after 10 hops, the tool warns that it may be a loop.
What do the status codes in the expanded chain mean?
A 301 is a permanent redirect and a 302 or 307 is temporary; either one passes you to the next URL. The final hop normally shows 200, meaning a real page answered there. A 4xx or 5xx at the end means the destination is broken or gone, which is common with old short links.
Which short link services can the URL expander unshorten?
Any service that uses standard HTTP redirects, which covers bit.ly, t.co, TinyURL, lnkd.in, ow.ly, is.gd, buff.ly, rebrand.ly and most others. Links that wait on an interstitial page or use a JavaScript countdown cannot be followed past that page.
What does the clean link in the URL expander remove?
It removes utm_ campaign tags and common click IDs such as fbclid, gclid, msclkid, mc_cid and igshid. Everything else in the address stays, because other parameters are often needed for the page to work. The box only appears when there was something to remove.
Why can the URL expander not read the destination page title?
The destination may block automated requests, need a login, or be a file such as a PDF rather than a web page. The redirect chain is still accurate in that case. Only the title and description preview are missing.
Does the URL expander follow JavaScript or meta refresh redirects?
It follows HTTP redirects, the kind nearly every shortener uses, and then reads the destination page. If that page sends visitors on with a meta refresh tag or a simple JavaScript redirect, the tool shows the next address and offers to expand it too. Redirects built by complex scripts can still be missed.
Is it safer to unshorten a link before clicking it?
Yes. You see the real domain first, and a short link that ends at a login page on an unfamiliar domain is a classic phishing sign. Expanding does not prove a site is safe, but it removes the guesswork about where you are going.
Will expanding a shortened link count as a click on it?
It may. The shortening service sees a visit from our server, not from you, and some services count that in their statistics. Your own IP address and browser are never shown to the link owner.
What do the safety hints in the URL expander check?
They look at the final address: whether it uses HTTPS, when the domain was registered (a domain only days old is a common phishing sign), punycode that can hide look-alike letters, bare IP addresses, several shorteners stacked in a row, and words like login or verify in the path. They are hints, not a malware scan.