How to Check Where a Short Link Goes Before You Click It
A text says your parcel is held. There is a link, six characters long, and nothing else. No sender name. You want to know where this link goes before you tap it.
Copy the link instead of tapping it. A bit.ly link previews itself if you add a +. Anything else goes into a free expander, which follows the redirect on its own server and shows you the address.
Bitly and TinyURL will both tell you themselves, with no third party involved.
Where does this link go? Copy it first
On a phone, press and hold the link and copy it. On a desktop, right-click and copy the link address.
A long press only shows the link's own address, and for a short link that is still the short link. It does not follow the redirect, so it cannot name the destination. A short link is just a stored redirect, and here is how that works.
Which link checkers still work?
Every tool below was pointed at the same link on 19 September 2026: a TinyURL going to example.com/hello, a harmless reserved test address.
| Tool | What it gives you | The catch |
|---|---|---|
| WhereGoes | Every hop in the redirect chain | Makes a public trace page anyone can open |
| unshorten.me | The final address as plain data | Tight limit without an account |
| ExpandURL | The final address plus the headers | Resolves only. No safety verdict |
| CheckShortURL | The final address | Dated, but it worked |
One caveat on all four. We checked whether they resolve a link, not whether they are run by people you should trust. An expander sees every link you paste, and none of these were vetted for anything beyond working.
Two shorteners have a preview of their own, and no third party sees the link at all.
- Bitly. Add a
+to the end of abit.lylink.bit.ly/bitlydocs+returned a page listing the destination and the link's creation date. It does not work on Bitly's branded domains:bitly.is/Bitly+returned a 404. Bitly sells branded domains to its paying customers, and the plus sign fails on those. There is more in our guide to expanding a Bitly link. - TinyURL. Open
tinyurl.com/preview/<slug>. It printed "Redirects to" and then the full address. The olderpreview.tinyurl.comform answered a 403 instead, so use the newer path.
Which checkers are dead?
This is the part most guides get wrong. One name on almost every list of expanders is gone.
urlex.org does not resolve at all. Its DNS answers SERVFAIL, so there is no site to load. It is still recommended all over the web.
So check the date on any list of link checkers you read. These sites are small and they go quiet without announcing it.
What works on a locked-down work laptop?
If curl is on your machine already, you need no website and no install:
curl -sI https://tinyurl.com/yjqg3sug
It printed:
HTTP/2 301
location: https://example.com/hello
Read two lines. The status code 301, 302, 307 or 308 means this is a redirect, and the location: header is the destination.
-I sends a HEAD request, which asks for the headers and not the page. -s hides the progress meter. curl does not follow redirects unless you add -L, so leave it off.
Some servers refuse HEAD and answer 405 or 403. Then send a normal request and throw the page away:
curl -s -o /dev/null -D - https://short.link/abc
Two honest limits. You see the first hop only, and chains are common. The server also learns that someone touched the link.
Why does Google's Safe Browsing checker say nothing?
Because it has nothing on any single short link. Pasting the test link into Google's Safe Browsing site status returned a status of No available data.
Google's own page explains why: it is hard to give a simple safety status for sites like tinyurl.com, which have a lot of content.
Strip the link back to the domain and you get a verdict about the shortener, not about the page you were sent to. Plenty of articles tell you to do this. It does not work.
Is reading the address enough?
No, and here is the trap. In https://www.google.com@example.org/, everything before the @ is a username. It is not the site.
Tested in Chrome on 19 September 2026, that address went to example.org, with no warning at all. Nothing touched Google. MDN calls this a semantic URL attack.
The real host is whatever follows the last @, and everything before it can say anything at all.
Many articles say browsers fixed this. Chrome has not. What did change is narrower: once you arrive, the address bar hides the username part.
Link text lies in the same way. It can read paypal.com and point anywhere. There are more tells in our guide to spotting an unsafe link.
What are you publishing when you paste a link?
A scanner is safe for your device, but it can be quite unsafe for your privacy.
VirusTotal's published terms say it in capitals: IF YOU DO NOT WANT TO PUBLICLY SHARE A SAMPLE, DO NOT SEND IT. Its submission form says the same in plainer words. You agree to the sharing of your URL submission with the security community.
urlscan.io had Public preselected when it was checked, and its home page runs a live feed of other people's public scans. Its own guidance on scan visibility lists what people wrongly publish there: invoices, document signing requests, password reset links.
So paste the domain only when you just want a reputation check. If the whole link was addressed to you, set the scan to Unlisted or Private. WhereGoes makes a public trace page too.
No checker knows about a page made an hour ago
This is the limit that matters more than the tool you pick.
Every scanner is a lookup against what has already been reported. A phishing page set up this morning has no history, so it comes back clean or with no data.
A clean result means nothing is known against it. It never means the page is safe.
Shorteners do not check for you either. Bitly names no threat feed in any of its public policies, and its Trust Center describes internal technology and unnamed abuse-detection vendors instead. TinyURL's terms are blunter: you access linked sites entirely at your own risk.
So build the habit rather than trusting the tool. Read the destination domain yourself. And never type a password or a card number on a page you reached from a link you were not expecting.
Common questions
Does opening a short link tell the sender anything?
Yes. The server sees your IP address, your rough location and your device. Scam links are often coded for one recipient. Opening one can confirm that your number or email is live and reachable. That is the main reason to copy rather than tap.
Does the padlock mean the page is safe?
No. Google removed the padlock from Chrome in Chrome 117, in September 2023. Its stated reasons: the icon did not indicate trustworthiness, and nearly all phishing sites use HTTPS. Google also found that only 11% of its study participants understood the icon.
Can one short link go to two different places?
Yes. Shorteners sell routing by country and by device, Bitly included. A checker running in a data centre can be shown a different page from the one your phone gets. Treat a preview as evidence, not as proof.
Is it risky to run a suspicious link through a scanner?
Not for your device. urlscan.io fetches the page itself, and its FAQ says the site will never learn your IP address. The risk is disclosure instead: a public scan can publish the link, and anything inside it.
What to do next
Three steps, in order. Copy the link, expand it with one of the tools above, then read the destination domain. Ignore everything before the last @.
If that domain is not the one you expected, stop there. No tool can make that judgement for you, and the newest scams are the ones no tool has heard of yet.
clik.so runs a free link checker for the middle step. Paste a short link and it reports the address at the far end, with no account.