Short URL Expander
Reveal where a shortened link actually goes — before you click. Paste a bit.ly, t.co, tinyurl, ow.ly, buff.ly or custom short URL and see every hop, the final destination, and the tracking parameters attached along the way.
Final URL
Shows the full destination URL with all redirect hops resolved.
Tracking params
Surfaces UTMs and tracking IDs added by the shortener.
Safe-by-default
We follow the redirect server-side. Nothing loads in your browser.
What it does
Click safely — or not at all
Short URLs hide their destination. That is useful for sharing — and convenient for attackers. This tool resolves the full chain server-side so you can see exactly where a link points without exposing your browser, IP, or referrer.
Resolves every shortener
Works with bit.ly, t.co, tinyurl.com, ow.ly, buff.ly, goo.gl (archived), youtu.be, lnkd.in, fb.me, and any custom short domain that uses HTTP redirects.
Multi-hop chains
Many shortened URLs hop through multiple services before landing. We follow up to 20 hops and render each one.
Tracking parameter visibility
See utm_source, gclid, fbclid, and tracking IDs appended at every hop. Strip them before sharing if you want a clean URL.
No browser exposure
We fetch from a Cloudflare Worker. Your IP, your cookies, and your referrer never touch the destination.
Bot vs human
Some shorteners serve different destinations to bots vs humans (cloaking). Switch UA to Googlebot to detect this.
API access
Same engine at /api/check. Integrate into moderation pipelines or email scanners to auto-resolve shortened links at scale.
How it works
Three steps, full transparency
Paste, trace, read the final URL. Your browser never visits the destination.
- 1
Paste the short URL
Drop in the bit.ly, t.co, tinyurl, or any other shortened link. We accept full URLs (https://bit.ly/abc) or just the path.
- 2
Server-side trace
A Cloudflare Worker follows the redirect chain. Nothing executes in your browser. The destination never sees your IP or cookies.
- 3
Read the destination
The final URL, every hop in between, and any tracking parameters added by the shortener are displayed. Click only if it looks safe.
Who uses it
For anyone evaluating a link before they click
Short URLs hide their target — useful for sharing, risky for receiving. These are the contexts where expansion matters.
Email and DM scanners
Verify what a shortened link in a suspicious email actually points to — without visiting it. Most phishing campaigns rely on shorteners to bypass email filters.
Social-media moderators
Review reports about shortened URLs in posts or DMs. Get the full destination URL in one click for evidence and escalation.
Marketers verifying campaign links
Confirm your bit.ly link still resolves to the right URL, with the right UTMs, after editing the destination in your shortener dashboard.
Researchers tracing redirect chains
Some shorteners chain through tracking services before reaching the destination. Trace the full path to understand who is being notified about each click.
Customer support investigating phishing reports
A customer received a "suspicious link" — paste it here, get the final URL, decide whether to escalate.
Journalists verifying sources
Trace where leaked or shared shortened URLs actually point to before quoting or sharing them.
Best practices
Stay safe with shortened links
Five habits that keep your team out of trouble when shortened URLs cross your inbox or feed.
visibility Always expand before clicking
Short URLs hide both the destination and the tracking. Expand first — it takes one second and prevents phishing, malware, and accidental tracking opt-in.
shield Use a server-side expander, not a preview extension
Browser preview extensions fetch the destination from your browser, exposing your IP and cookies. A server-side tool (like this one) does not.
business Use your own shortener for outbound links
A custom domain shortener (e.g. links.yourbrand.com) lets you control destinations, rotate them if compromised, and avoid trust issues with generic services.
track_changes Audit tracking parameters before sharing
Shorteners often inject UTMs and click IDs. If you redistribute the link, you may be passing through analytics from another team or company.
rule Never click shortened links in cold outreach
Legitimate vendors include the full URL or use their own branded shortener. Generic shortened links in unsolicited emails are a phishing red flag.
FAQ
Common short-URL questions
Which shorteners does this work with? expand_more
Any service that uses HTTP redirects to send users from a short URL to a long one. That includes bit.ly, t.co, tinyurl.com, ow.ly, buff.ly, lnkd.in, fb.me, youtu.be, goo.gl archives, rebrand.ly, custom links.yourbrand.com domains, and the long tail. The only shorteners that will not work are ones that serve an HTML interstitial and require JS to advance — those are rare.
Is it safe to expand a suspicious URL here? expand_more
Yes. The request is made from a Cloudflare Worker, not from your browser. Your IP address, cookies, and referrer are not sent to the destination. The destination server sees a Cloudflare IP and the user-agent string you select — nothing personally identifying.
Will the destination know I expanded the link? expand_more
It will see a server-side request, but not from you. The destination server cannot tell whether the request came from a human visitor, a bot, or our expander — and even if they could, the trail leads back to our Cloudflare Worker, not to you.
Why are there so many hops? expand_more
Many shorteners chain through multiple analytics or affiliate services before reaching the final destination. A bit.ly link might go bit.ly → tracking.example.com → utm-rewriter.example.com → final destination. Each hop is a chance for a service to count the click. Use the chain rendering to see who is in the path.
Can you decode the shortener back to the original creator? expand_more
No. This tool resolves the redirect; it does not reveal who created the short URL. For that you would need the shortener provider to disclose the account (usually only available with a subpoena or to the shortener's own dashboard).
Does the expander work for custom short domains? expand_more
Yes. As long as the domain uses standard HTTP 301/302 redirects (which 99% of branded shorteners do), it works. Try your own links.example.com or shorturl.example.io and you will see the same chain rendering.
Can I batch-expand many short URLs? expand_more
Yes — use the bulk checker at /bulk. Paste up to 100 URLs and export the final destinations as CSV. Useful for security and compliance reviews of historical campaign data.
Reveal the real URL
Paste any shortened link above. See the full destination and every hop in between — without leaving your browser tab.
north Expand a short URL