Link Expander: See Where a Short Link Really Goes
Paste a bit.ly, TinyURL or any other short link to see every redirect and the final website before you tap it. Get a clean link without tracking codes, and check the destination's safety in one click.
- Link never opens on your device
- Shows every redirect
- Removes tracking codes
Redirect path
Warning signs
How to test it
- Press http://google.com. You should see it move to https and then to www.google.com.
- Paste a short link you received, such as bit.ly or TinyURL, and press Expand link.
- Press Check final site's safety to check the destination with Google Safe Browsing and VirusTotal.
Links are followed by our server, never opened in your browser. 20 links per hour.
How this link expander works
Follows one step at a time
Our server asks the link where it goes, then asks the next address, up to 10 steps. It reads HTTP redirects, meta refresh and simple script redirects, without running anything.
Flags the risky parts
Each step is checked for lookalike bank or government names, risky domain endings, raw IP addresses, app downloads, unencrypted pages and long redirect chains.
Cleans and checks
The final address is shown without tracking codes like utm_source and fbclid, and one press checks it with Google Safe Browsing and VirusTotal.
Check it yourself. Open your browser's developer tools (F12), choose the Network tab and expand a link. Your browser only talks to our site: the short link and every page it leads to are never loaded on your device.
When to expand a link first
Short links hide where they go. These are the times it matters most.
| Situation | What to look for | Action |
|---|---|---|
| A bit.ly link in an SMS about KYC, a parcel or a refund | A final site that uses a bank or India Post name but isn't the official website. | |
| A forwarded WhatsApp "free offer" or job link | Long chains through several unknown sites, and endings like .xyz or .top. | |
| A link that says "update the app" or "install now" | A final step that downloads an .apk or .exe file. | |
| Sharing an Amazon, Flipkart or news link | Use the clean link, which removes tracking codes. | |
| The link came from a QR code | Check the QR itself first. It shows payments and links together. | QR Code Scam Checker |
How redirects work
A short link is an address whose only job is to say "go somewhere else". Your browser follows that instruction instantly, so you never see the steps in between, and one of them can be a tracker or a scam page.
The expander asks each address in turn with a plain request, reads at most 64 KB of each page, and stops at the first page that shows content, after 10 steps, or if a step loops back. It never sends cookies or your details.
For safety it refuses addresses that point into private networks, use unusual ports or hide a username and password, which is how attackers try to misuse link checkers.
Sources: MDN: Redirections in HTTP, RFC 9110 (3xx status codes).
Redirect types you may see
| Type | Meaning | Notes |
|---|---|---|
| 301 | Moved permanently | The link has a new permanent address. Common for short links and http to https. |
| 302 / 303 | Found, see other | A temporary jump. Used by shorteners and click trackers. |
| 307 / 308 | Temporary or permanent redirect | Like 302 and 301, but the request method stays the same. |
| Meta refresh | A page that reloads to another address | Often used by trackers and interstitial pages. |
| Script redirect | JavaScript sends you onward | Sometimes used to hide the real destination from checkers. |
| 200 OK | The final page | The address that actually shows content. |
Link mistakes scammers rely on
Short links make these easy to miss.
Anyone can make a short link to anywhere. The short link's name tells you nothing.
The real site name is the part before the ending. Here it's kyc-update.xyz, not SBI.
Some pages start downloads or ask for permissions straight away. Expand first.
Logos are easy to copy. Only the address bar proves which site you're on.
Safe link habits
Before tapping
- Expand short links from unknown senders.
- Long-press a link on your phone to preview the address.
- Type bank and government addresses yourself.
- Never install apps from links; use the Play Store or App Store.
- Don't enter OTPs or card details after following any link.
When sharing
- Share the clean link without tracking codes.
- Prefer the full address over a short link, so people can see it.
- Tell family not to forward "free offer" links.
- Report scam links in WhatsApp and on Sanchar Saathi.
- Check the message around the link too.
Frequently asked questions
Short answers about privacy, tracking codes and safety.
Does expanding a link open it on my device?
No. Our server follows the link one step at a time and reads only the address it points to and the final page's title. Nothing runs in your browser, so a harmful page can't download files or scripts to your device.
Can the website see that I checked its link?
The website sees a visit from our server, not from you. It doesn't learn your IP address, device or location. Some shorteners count it as a click.
Why does the final page differ from what I see on my phone?
Some links send phones, computers or visitors from different countries to different places, and some scam links show a harmless page to checkers. Treat the result as a strong hint, and still don't enter details on a page you don't trust.
What are tracking codes and why remove them?
Codes like utm_source, fbclid and gclid tell the website where you came from. The clean link opens the same page without them, which is tidier to share and gives away less about you.
Which short links does it work with?
Any web link that redirects: bit.ly, TinyURL, t.co, cutt.ly, rb.gy, is.gd, Amazon and Flipkart share links, and more. It also follows meta refresh and simple script redirects.
Why was a link not opened?
For safety the expander doesn't open links that point to private or internal network addresses, unusual ports, or addresses that hide a username and password. Those are common in attacks, so they're reported instead.
Is there a limit?
You can expand 20 links an hour and 100 a day. Results are remembered for an hour, so checking the same link again is instant.