FreeurlA friend texts you a link that looks like tinyurl.com/3xk9p2 with the message "is this you in the photo?" You have no idea where it goes. Do you click? Are short links safe? They are not dangerous by themselves, but they hide the destination, and that is exactly what makes them handy for scammers.
The good news is that you can check a short link in under a minute without opening it. This guide lists seven checks, in the order we would run them, and explains what a link shortener can and cannot do to protect you.
Why short links worry people
A normal web address shows you the site name, so you can often spot a fake at a glance. A short link replaces all of that with a few random characters. You cannot tell whether it leads to a recipe blog or to a page that pretends to be your bank.
Scammers use this on purpose. Phishing messages try to get you to type a password or a card number into a fake page, and a short link keeps the fake address out of sight until it is too late. The Federal Trade Commission describes the common patterns of these messages on its consumer site, linked below.
To be fair, the same trick is used for good reasons all the time. Businesses shorten links for text messages, printed menus and social posts, and most short links you meet are harmless. The point is not to fear every short link. It is to have a habit that takes a few seconds.
Check 1: look at who sent it and why
Before you look at the link at all, look at the message. Were you expecting it? Does the sender normally write like this? A link from a friend whose account may have been hacked, or from a number you do not know, deserves more doubt than a link in a newsletter you signed up for.
Be extra careful with messages that push you to act now: "your parcel is held", "your account will be closed", "you won a prize". Urgency is the scammer's main tool, because it stops you from thinking.
Check 2: preview the destination without visiting it
This is the most useful step. Instead of clicking, paste the short link into an unshortening tool. Ours is the unshorten tool. It follows the link for you, reports where it ends up, and does not open the page in your browser.
Many shorteners also let you add a plus sign to the end of the link to see a preview page. On Freeurl, adding + to the end of a short link opens its public analytics page instead of redirecting. Not every service supports this, so the unshortening tool is the more reliable option.
Check 3: read the real domain carefully
Once you can see the destination, read the part right before the first single slash. That is the real domain. Everything else is decoration.
- paypal.com/login goes to PayPal.
- paypal.com.account-check.net/login goes to account-check.net. PayPal is only a decoy at the start.
- paypa1.com uses the number 1 in place of the letter l.
Look for misspellings, extra words such as "secure" or "verify" in the domain, and unusual endings. Some domain endings are cheap and popular with abusers, though a strange ending alone proves nothing.
Check 4: be suspicious of login pages you did not ask for
If the link opens a page that wants a username and password, ask yourself why. Did you click something that should need a login? If the page claims to be a service you use, close it and open that service yourself, by typing its address or using its app. Then check whether there is really a message waiting for you.
The padlock icon in the browser bar does not prove a site is honest. It only means the connection is encrypted. Criminals can get encryption certificates for their fake sites just as easily as anyone else.
Check 5: watch for downloads
A link that starts a file download without warning is a red flag. Files ending in .exe, .msi, .apk, .scr or .bat can run code on your computer or phone. Even a harmless-looking .zip or .pdf from a stranger should be treated with caution. We block links to common executable file types, but other shorteners may not, and we cannot catch every case.
Check 6: use a scanning service
If you still are not sure, run the destination through a reputation checker. Google's Safe Browsing keeps lists of sites known for phishing and malware, and its transparency report lets you look up an address. Browsers such as Chrome, Firefox and Safari already use these lists to show warning pages. If your browser shows a red warning screen, believe it.
No scanner is perfect. A brand-new scam page may not be on any list yet, so a clean result lowers the risk, it does not remove it.
Check 7: know how to report a bad link
If a short link turns out to be a scam, report it. Every report helps shut the link down and protects the next person who receives it. On Freeurl you can use the report abuse form to flag a link for phishing, malware or other abuse. We review reports and disable links that break our rules. If you shared your details on a fake page, change that password right away and turn on two-step sign-in where you can.
What a link shortener can and cannot do
We want to be straight about this. When someone creates a short link on Freeurl, we check the destination against safety lists and our own rules before the link goes live, and we hold suspicious ones for review. That stops many bad links, but it cannot stop all of them. A destination can look clean on day one and be changed to something harmful a week later, and we cannot see every page on the internet.
That is why the seven checks above are worth keeping as a habit, no matter which shortener sent you the link. Treat the shortener as one layer of protection and your own judgment as the other.
A quick routine to remember
Pause before you click. Ask who sent it. Preview the real address. Read the domain. Be wary of login pages and downloads. When in doubt, go to the real site yourself. It adds about thirty seconds, and it covers most of the risk.
Frequently asked questions
Is it safe to click a shortened link?
Not always. A short link hides its destination, so preview it first with an unshortening tool if you do not trust the sender.
Can I see where a short link goes without clicking?
Yes. Paste it into an unshorten tool, which follows the link for you and shows the final address.
How do I report a malicious short link?
Use the report abuse form on the site that created the link, and report the scam message to the platform where you received it.
Does the padlock mean a site is safe?
No. It only means the connection is encrypted. Scam sites can use encryption too.