You have seen them everywhere -- those compact links from bit.ly, t.co, tinyurl.com, and dozens of other shortening services. They show up in social media posts, text messages, emails, and even printed on flyers. They are convenient, easy to share, and impossible to read. That last part is the problem.

When you click a full URL like https://example.com/products/sale, you can see exactly where you are headed. When you click https://bit.ly/3xK9mPq, you have no idea. It could lead to a legitimate article, a product page, a phishing site designed to steal your password, or a page that silently downloads malware onto your device.

Understanding what actually happens behind the scenes when you click a shortened URL is the first step toward staying safe.

How URL Shorteners Work

URL shortening services are simple in concept. You give them a long URL, and they give you back a short one. Behind the scenes, the service stores a mapping between a short code (like 3xK9mPq) and the original long URL in a database.

When someone clicks the short link, the shortening service receives the request, looks up the short code, and sends an HTTP redirect response -- typically a 301 or 302 redirect -- that tells your browser to go to the original long URL instead.

The entire process happens in milliseconds. Your browser follows the redirect automatically, and most people never notice it happened at all. But that single redirect is where the risk lives, because you are trusting the shortening service and whoever created the link to send you somewhere safe.

Why Shortened URLs Can Be Dangerous

The core problem with shortened URLs is that they strip away the one piece of information you could use to make an informed decision: the destination. This makes them a favorite tool for several types of attacks:

Hiding phishing links -- An attacker can shorten a URL that points to a fake login page for your bank, email provider, or social media account. The short link gives no hint that the destination is malicious.
Masking malware downloads -- Shortened links can lead to pages that trigger automatic downloads of harmful software. By the time you see what is happening, the damage may already be done.
Obscuring tracking and data harvesting -- Some shortened URLs pass through multiple intermediate domains that collect your IP address, browser fingerprint, location, and other data before eventually landing you on the final page.
Bypassing URL filters -- Security tools that block known malicious domains can be circumvented when the dangerous URL is hidden behind a trusted shortening service. The filter sees bit.ly and lets it through.

For a deeper look at these risks, see the guide on URL shortener risks.

The Anatomy of a Redirect Chain

When you click a shortened URL, your browser goes through a multi-step process that usually completes in under a second. Here is what happens at each stage:

Your browser sends a request to the shortening service's server (for example, bit.ly).
The server looks up the short code in its database and finds the associated destination URL.
The server responds with an HTTP 301 or 302 status code and a Location header containing the destination URL. This tells your browser to go somewhere else.
Your browser automatically follows the redirect and sends a new request to the destination URL.
If the destination itself redirects, the process repeats. Some links pass through two, three, or even five redirects before reaching the final page.
Your browser finally loads the last page in the chain, which is the one you actually see.

Each step in this sequence is a hop in what is known as a URL redirect chain. The more hops there are, the harder it becomes to know where you will end up -- and the more opportunities there are for one of those intermediate stops to log your data or redirect you somewhere harmful.

How to Safely Check a Shortened URL

The safest approach is to find out where a short link leads before you click it. There are several ways to do this:

Use a URL unwrapper -- The URL Unwrapper follows the entire redirect chain for you and reveals the final destination without your browser ever visiting it. Paste in the short link, and you will see every hop along the way.
Run it through a link checker -- The Link Safety Checker goes a step further by not only resolving the redirects but also checking the final destination against threat databases like Google Safe Browsing. You get a clear verdict on whether the link is safe, suspicious, or dangerous.
Read up on link safety -- If you are not sure what to look for when evaluating a URL, the Is This Link Safe? page walks you through the warning signs and gives practical advice for assessing any link you encounter.

These tools are free and take only a few seconds to use -- far less time than recovering from a compromised account or a malware infection.

Tips for Staying Safe With Short Links

Beyond using dedicated tools, these habits will help you handle shortened URLs more carefully:

Use preview features when available. Some shortening services offer a built-in preview. For example, adding a + to the end of a bit.ly link (like bit.ly/3xK9mPq+) shows you the destination without following the redirect. Not all services offer this, but it is worth trying.
Be extra cautious with short links in emails and DMs. These are the most common delivery channels for phishing attacks. If you were not expecting the message, do not click the link without checking it first.
Look at the context. A shortened URL in a news article from a trusted outlet is lower risk than one in an unsolicited text message from an unknown number. Context matters.
Consider a browser extension. Some browser extensions automatically expand shortened URLs so you can see the destination before clicking. This adds a layer of protection without requiring you to manually check every link.
Do not assume a known shortening service means safety. Anyone can create a bit.ly or tinyurl link. The shortening service itself is neutral -- it does not verify whether the destination is safe.
When in doubt, do not click. If a shortened URL feels suspicious and you cannot verify it, skip it. No link is worth the risk of a compromised device or stolen credentials.

The Bottom Line

Shortened URLs are not inherently dangerous, but they remove your ability to see where you are going before you get there. That lack of transparency is what makes them risky. By understanding how redirect chains work, using tools like the URL Unwrapper and Link Safety Checker to inspect links before clicking, and building cautious habits around unfamiliar short links, you take back control over where your browser takes you.

Stay skeptical of links you cannot read, and always check before you click.

What Happens When You Click a Shortened URL?