Are URL shorteners safe?

The real problem: you cannot read the destination

When you see a full URL, you evaluate it almost without thinking. The domain tells you who is asking, and a mismatch between the claim and the domain is what makes phishing detectable. A short link deletes that signal. Every short URL looks the same whether it leads to a bank, a blog, or a credential harvester dressed as a bank.

This is not a flaw that a shortener can design away, because it is the feature. Anything that makes the destination visible in the link makes the link long again. What a shortener can do is limit the damage around the edges — and what you can do is check before you click.

How to check a short link before opening it

• Ask for the headers instead of the page. curl -I <short-url> prints the redirect target in the Location header without loading anything. This is the most reliable method and it involves no third party.
• Use a link expander. Several free services resolve a short URL and show you the chain. Note that you are handing the link to that service, which is a reasonable trade for a suspicious link and a poor one for a confidential link.
• Do not trust hover. The status bar shows the short URL, which tells you nothing about where it ends up.
• Treat unexpected short links as unsolicited. A short link in a message you were not expecting, especially one creating urgency about an account or a payment, deserves the same suspicion as any other unexpected link — more so, since you cannot see where it goes.

The risk nobody mentions: the click itself is data

Phishing gets the attention, but the routine cost of clicking a short link is surveillance. Most shorteners log every click: IP address, the location derived from it, device and browser, the referring page, and a timestamp. Whoever created the link can see all of it, and so can the shortener.

That is how a link in a newsletter tells the sender you opened it, from where, and on what. It is not an attack — it is the business model. But it means "is this link safe?" has a second answer beyond "does it go somewhere malicious?", and it is one you rarely get told about.

Linkonda is built the other way round: the redirect increments a counter and stores nothing about the visitor. No IP address, no geolocation, no user agent, no referrer and no record of who clicked. Short links set no cookies. What is and is not recorded sets out the full list, and the GDPR page covers what that means if you are the one sharing the links.

What to look for when choosing a shortener

• A stated retention policy. If the service does not say what it keeps about the people who click, assume it keeps everything.
• Links you can switch off. If a destination turns bad, or you published the wrong one, you need a way to stop the redirect immediately. Pausing is available on every signed-in Linkonda account; editing the destination is a paid feature.
• A domain you can leave with. A custom domain means your links are not hostages to someone else's reputation or business decisions — and recipients can see your brand in the link, which restores some of the trust signal a short URL removes.
• Limits on anonymous creation. A service that lets anyone mint unlimited permanent redirects with no account will be used to do exactly that. Linkonda caps anonymous links at 10 active per network and expires them after 30 days, which makes it a poor tool for anyone at scale.

If you are the one sharing the link

Most of the trust problem is solved by not being anonymous. Use a custom domain so the link carries your name. Say where the link goes in the surrounding text, rather than making people take it on faith. Keep the destination stable, so a link you shared last year still means what it meant then.

And if you are sharing something sensitive, remember that the short link is not a secret — it is a short, guessable-looking string on a public host. It controls where a visitor is sent, not who is allowed to go there. Access control belongs on the destination.

Frequently asked questions

Are URL shorteners safe to use?

Shortening a link you control is safe. Opening someone else's short link carries the risk that you cannot see where it goes until you are already there. The danger is not the technology — it is that a short URL removes the one signal people normally use to judge a link, which is the domain name.

How can I see where a short link goes before clicking it?

Use a link expander, or request the URL with a tool that shows redirects without following them — curl with the -I flag prints the Location header without loading the page. Some shorteners also support a preview mode. Do not rely on hovering: the status bar shows the short URL, not its destination.

Can a short link contain malware?

The link itself is only a redirect and carries nothing. The page it sends you to can be anything, including a phishing page or a malware download. A shortener is a delivery mechanism, not a payload.

Can whoever made the short link see who clicked it?

With most shorteners, yes — clicking records your IP address, approximate location, device and referrer, and the link's creator can see all of it. Linkonda records only a total count, with no per-visitor data of any kind, so there is nothing about you to show anyone.

Is it safe to put a short link in a QR code?

The same caution applies, and more strongly: a QR code hides the address completely, and phones often open it with one tap. Scan codes from sources you trust, and check the URL your camera previews before opening it.