Unshorten a URL
Expand bit.ly, t.co, tinyurl and other short links to see the full destination, and every redirect in between, without opening them.
This tool needs a server. Following a redirect without being carried along by it is something a browser is not permitted to do, so ours does it and reports back. Only the address you paste is sent; nothing is stored, and the page at the other end is never downloaded.
What this does
A short link tells you nothing. bit.ly/3xKp2Qm is the same shape whether it
leads to a news article, a shop, or a page that wants your password. Paste one
above and this follows it for you, listing every address it passes through and
where it finally lands — without your browser ever visiting any of them.
The chain matters as much as the destination. A link that goes through four different domains before arriving somewhere is behaving differently from one that jumps straight there, and that is visible here in a way it never is when you simply click.
Why a browser cannot do this for you
Every other tool on this site runs entirely in your browser. This one cannot, and the reason is worth knowing.
When a page asks for a URL and tells the browser not to follow the redirect, it gets back what the specification calls an opaque response: a sealed object with no status code, no headers, and no destination readable from it. And if you let the browser follow the redirect instead, you have visited the link, which is the exact thing you were trying to avoid.
That restriction is not an oversight. Without it, any page you opened could quietly probe every address on your home network using your browser as the way in. So the check has to happen somewhere that is not your browser, and here that means our server does it and reports back what it saw.
What is sent, and what is not
Only the address you paste. It is used to make the request and is not written to any log or database of ours.
The page at the other end is never downloaded — not its HTML, not its images,
nothing. The server asks each address what its status is and reads only the
Location header that says where to go next. So the destination site sees a
request arrive, but nothing about it comes back here beyond a number and an
address.
Redirects this cannot see
Following a chain means following HTTP redirects — the 301, 302, 307 and
308 responses a server sends. Some links redirect in ways that live in the
page instead:
- A meta refresh, written into the HTML as
<meta http-equiv="refresh">. - A JavaScript redirect, which only happens once a real browser has run the script.
- An interstitial, where the destination appears only after you click through a warning or an advert.
In all three the chain here ends at the page that contains the trick rather
than at the final address. That is itself a signal: a shortener that stops at
an unfamiliar domain with a 200 rather than redirecting onward is doing
something a plain shortener does not need to do.
Links can also be targeted. Some services send different destinations to different visitors based on country, device or the time of day. Our server is in a data centre and is not on a phone, so a link built to behave one way for a mobile visitor and another way for everyone else may show you the second one.
Status codes you will see in the chain
| Code | Means |
|---|---|
301 | Moved permanently — the standard redirect for a link that has a new home |
302 | Found — a temporary redirect, and what most shorteners actually use |
303 | See other — redirect to a different resource, usually after a form |
307 | Temporary redirect, keeping the original method |
308 | Permanent redirect, keeping the original method |
200 | The end of the chain: this address answered rather than forwarding |
404 | Nothing there. Expired shortlinks often land here |
403 / 405 | The address refused the request, sometimes because it blocks automated checks rather than because the link is dead |
Addresses that will not be expanded
The lookup only follows public web addresses. If a link — or any redirect
inside it — points at a private network, this stops and tells you rather than
fetching it. That covers loopback addresses like 127.0.0.1, private ranges
such as 192.168.x.x and 10.x.x.x, link-local addresses including the
169.254.169.254 that cloud providers use for machine credentials, and names
that only resolve inside a network.
A shortlink pointing at one of those is not a mistake — it is someone trying to use a public tool to reach somewhere they cannot reach directly. Non-web schemes, custom ports, and links pointing back at this site are refused for the same reason.
A shortened link is not the only trick
Expanding a link tells you where it goes. It does not tell you the destination is safe. Two things worth checking on the address you get back:
- Read the domain from the right. In
paypal.com.secure-login.example, the real site isexample— everything before it is decoration. The last two labels before the first slash are the ones that matter. - Watch for lookalike characters. Domains can contain letters from other alphabets that render almost identically to Latin ones. If a domain looks right but you arrived at it from an unexpected message, type the address in yourself rather than following the link.