How to Check Where a Shortened Link Goes Before You Click

A practical checklist for expanding unfamiliar short links, inspecting redirects, and recognizing suspicious destinations without taking unnecessary risks.

A shortened URL hides the final address behind a compact link. That is convenient for sharing, but it can also make an unexpected destination harder to recognize. Before following a link from an unfamiliar sender, take a moment to identify where it leads.

Why the destination matters

A short link is normally an HTTP redirect: your browser requests the short address, receives a response pointing elsewhere, and continues to the destination. The redirect does not prove that the final website is legitimate. A link can point to a normal article, a removed page, a login form, or a deceptive copy of a trusted service.

Start with the context, not the URL

• Was the link sent by someone you expected to hear from?
• Does the message pressure you to act immediately?
• Is a payment, password reset, or account verification unexpectedly required?
• Does the organization normally contact you through this channel?

A recognizable short-link domain is not sufficient evidence of safety. Reputable shortening providers can still be abused by individual link creators.

Use a URL expander carefully

A URL expander or redirect checker can reveal the address a short link redirects to. Choose a trustworthy checker that explains what it does and does not guarantee. An expanded destination helps with inspection; it is not a security certificate.

For example, a link such as https://short.example/q8m2 might ultimately resolve to https://shop.example.com/sale. Inspect the complete hostname, not merely a familiar brand word somewhere in the URL.

What to inspect

• Hostname: accounts.example.com is not the same as accounts.example.com.attacker.invalid.
• HTTPS: encryption protects the connection but does not establish that a site is honest.
• Redirect path: several hops can obscure the final destination.
• Unexpected downloads: avoid downloading files or installing profiles from unsolicited links.

Can you inspect redirects with developer tools?

Technical users can inspect HTTP response headers with command-line tools. For example, curl -I requests headers, while curl -IL follows redirects and reports the headers at each hop. Note that some sites respond differently to HEAD requests, and tools that follow redirects still contact the remote hosts. Never run unknown links against a sensitive internal environment without appropriate protections.

curl -I https://short.example/q8m2

Look for an HTTP Location header on redirect responses. If a HEAD request fails, that does not necessarily mean the URL is broken.

When not to investigate further

If the message claims to be from your bank, a government service, or an employer and asks for credentials, use a previously known website or phone number rather than the supplied link. Do not enter passwords merely because the expanded URL looks plausible.

A quick checklist

1. Verify why the sender contacted you.
2. Expand the link using a trustworthy method, when appropriate.
3. Inspect the exact final hostname and redirect chain.
4. Be skeptical of urgent login and payment requests.
5. When in doubt, navigate independently to the organization's official website.

Frequently Asked Questions

Is a short URL automatically dangerous?

No. Shortening is an ordinary web mechanism; the risk depends on the creator, destination, and surrounding context.

Does a padlock mean the destination is safe?

No. HTTPS establishes an encrypted connection to a domain, not the trustworthiness of its operator.

Can a short link change after I check it?

Potentially, yes. Some services let owners edit destinations, and routing can vary by location, device, or time.

Conclusion

Expanding short links is useful, but it is only one layer of verification. Combine the destination check with careful inspection of the hostname and the original message before deciding to open a link.

Further reading

FTC: Scammers hide harmful links in QR codes — official guidance that also illustrates why unexpected links deserve scrutiny.