Free tool
Unshorten a URL
A short link tells you nothing about where it goes — that is its job. Paste one here and read the destination before you decide whether to open it.
Why short links hide the destination
Shortening exists for good reasons: character limits, printable links, QR codes, and click counts that the destination site would never share with you. The side effect is that the one piece of information people rely on to judge a link — the domain — is gone.
That is why the same technique serves both a creator putting twelve links in a video description and a phishing campaign putting one in an SMS. Expanding the link first costs a few seconds and removes the guesswork entirely.
Three ways to expand a link without clicking it
- 1
Use a checker
The tool above follows the chain server-side and prints every hop with the status it returned. It works for any shortener, including ones you have never seen, and for chains where one shortener hands over to another.
- 2
Use the shortener's own preview
Bitly shows an information page if you append a plus sign to the short URL. TinyURL does the same when you put preview. in front of the hostname. Both are quick, and both only work on their own links.
- 3
Ask the server yourself
curl -sIL followed by the URL prints the Location header of every redirect in the chain. It is the same request the checker makes, minus the explanation of what the parameters mean.
What to look at once it is expanded
Does the final domain match the promise?
A link presented as a bank, a courier or a login page should land on that company's own domain. This is where most phishing gives itself away.
Look for near-misses in the name
An extra word, a hyphen, a swapped letter, or a familiar brand sitting in the path instead of the domain. The domain is the part before the first single slash — everything after it is decoration.
Read the parameters
Affiliate parameters mean somebody earns a commission. Advertising click ids mean the visit came from a paid ad. Neither is dangerous, and knowing which is which stops a harmless link from looking sinister.
Count the hops
One or two redirects is normal. A chain of four or five through domains nobody recognises is worth a second thought before you hand over anything.
Shorteners the checker recognises by name
It works on any shortener, named or not. These are simply the ones it can label for you: t.co, ow.ly, buff.ly, rebrand.ly, cutt.ly, is.gd, v.gd, shorturl.at, rb.gy, tiny.cc, dub.sh, dub.co, short.io, snip.ly, s.id, mtr.cool, trib.al, lnkd.in, tr.ee, urlz.fr, clck.ru.
Frequently asked questions
How do I see where a short link goes without clicking it?
Paste it into the field above. The request is made from our server, the redirects are followed there, and you get the final address as text. Nothing loads in your browser and no page is rendered.
Is it safe to expand a suspicious link this way?
Expanding is much safer than clicking, because your browser never contacts the destination and never runs anything it serves. It is not a malware scanner though: it tells you where a link goes, not whether what waits there is trustworthy.
Can I expand a bit.ly link without any tool?
Yes. Append a plus sign to a Bitly link and it shows an information page instead of redirecting. TinyURL has the same idea with a preview. prefix on the hostname. Those only work for those two services, which is why a general checker is handy.
Why does one short link lead to another?
Because links get re-wrapped. A creator shortens an affiliate link that was already a tracker, someone shares it through a platform that wraps it again, and you end up with three hops. The checker shows each one.
The link expanded to something completely different from what I expected. What does that mean?
It can be entirely innocent — a redirect to a regional storefront, or a campaign URL. It can also be the point of the exercise. Compare the final domain with whatever the link was presented as, and be sceptical of near-misses like a hyphen or an extra word in a familiar brand name.
Do you store the links people check?
The resolved chain is cached for six hours so the same link is not fetched repeatedly, holding the URL and its destination but never who asked for it. After that it deletes itself.
Why did the last hop fail?
Plenty of large sites refuse anything that is not a real browser, so the final request can answer 403 or time out. The redirect chain leading up to it is still what it is, and that is normally the part you needed.
Wondering whether somebody gets paid for the click?
That is the other half of the question, and it has its own page: the affiliate link checker explains every tracking parameter and names the network behind the redirect.