Short URLs
P.Leclercq in Security 2023-10-25 technology

Decoding short URLs
While browsing the web, you have probably encountered references to web pages with a short and rather cryptic URL, like bit.ly/3rZ7Xws, t.co/sJpSI7yCEb, ow.ly/R7LE50PYCHn or tinyurl.com/yc5scfaw.
Short URLs
These are shortened URLs. They are not the real locations of the page you will read if you click, but they are shorthands. Bitly, Twitter/X, TinyURL, BL.INK, Zapier… are companies that allow you to use (for a fee - some have a limited free plan) a short URL under their domain name to point to a page with a more complicated path like https://www.my-isp.com/myblog/the-page-i-want-to-share-with-my-neighborhood.html.
Technically, they create a page at their site with a short name and use some code to redirect the reader’s browser to the original page (they use a HTTP redirect (301) or a HTML meta refresh statement) .
Shortened URLs hide the actual destination of a click on the link, so they can be easily exploited by pirates to drive a user to a malicious or counterfeit site.
Note also that these aggregator sites gather statistics on the clicks, so it is not optimal for privacy; it is better to directly connect to the original site.
How to decode short URLs
There are free websites that decode the shortened URLs for you without you actually accessing them.
-
unshorten.it not only expands the shortened URL, but it shows you a preview of the site and safety ratings.
-
checkshorturl.com does the job too, but with some ads and a more … extravert design. It is less efficient as previewing the website and limits your free translations to 120/day.
-
ExpandURL.net is also a simple site that creates and expands shortened URLs.
Conclusion
Before clicking on a shortened URL, expand it with the help of one of the sites above, and check the real destination is what you expect.