Philippe's blog

Short URLs

P.Leclercq in Security    2023-10-25   technology 

article header image

Decoding short URLs

While browsing the web, you have probably encountered references to web pages with a short and rather cryptic URL, like bit.ly/3rZ7Xws, t.co/sJpSI7yCEb, ow.ly/R7LE50PYCHn or tinyurl.com/yc5scfaw.

Short URLs

These are shortened URLs. They are not the real locations of the page you will read if you click, but they are shorthands. Bitly, Twitter/X, TinyURL, BL.INK, Zapier… are companies that allow you to use (for a fee - some have a limited free plan) a short URL under their domain name to point to a page with a more complicated path like https://www.my-isp.com/myblog/the-page-i-want-to-share-with-my-neighborhood.html.

Technically, they create a page at their site with a short name and use some code to redirect the reader’s browser to the original page (they use a HTTP redirect (301) or a HTML meta refresh statement) .

Shortened URLs hide the actual destination of a click on the link, so they can be easily exploited by pirates to drive a user to a malicious or counterfeit site.

Note also that these aggregator sites gather statistics on the clicks, so it is not optimal for privacy; it is better to directly connect to the original site.

Short URL redirection mechanism

How to decode short URLs

There are free websites that decode the shortened URLs for you without you actually accessing them.

  • unshorten.it not only expands the shortened URL, but it shows you a preview of the site and safety ratings.

    unshorten.it

  • checkshorturl.com does the job too, but with some ads and a more … extravert design. It is less efficient as previewing the website and limits your free translations to 120/day.

    checkshorturl.com

  • ExpandURL.net is also a simple site that creates and expands shortened URLs.

    expandurl.net

Conclusion

Before clicking on a shortened URL, expand it with the help of one of the sites above, and check the real destination is what you expect.

Home   Top