FreeurlSomeone sends you a bit.ly link in a text, a DM, or an email. You do not know the sender well, or the message feels slightly off. Before you tap, you want to see where the link goes. This guide shows you how to check a bit.ly link before you click it, using methods that never load the destination page on your device.
The short version: expand the link without visiting it, read the full address, and judge the domain. It takes about 30 seconds. The rest of this post explains each step, what to look for, and where this approach falls short.
Why a bit.ly link is hard to judge by eye
A link like bit.ly/3xYzAbC tells you nothing. The characters after the slash are an ID, not a hint. The real address is stored on the shortener's server, and your browser only learns it after you click and get redirected.
That is not a flaw in Bitly. It is what a short link is. But it means a bad link and a good link look identical. Scammers know this, which is why short links show up so often in phishing texts and fake "package waiting" messages. For a broader look at the risks, see our guide Are Short Links Safe? 7 Checks Before You Click.
The FTC's advice on unexpected messages applies here too. If you get a message with a link you did not expect, ask whether you actually have an account with that company or know the sender. If not, it could be phishing. The agency also says legitimate companies will not text or email a link to update your payment information. You can read its full guidance in How to Recognize and Avoid Phishing Scams.
Method 1: Use an unshorten tool (works for any short link)
The most reliable approach is to paste the link into a tool that follows the redirects for you. Our Unshorten a Link tool does this for bit.ly, t.co, Freeurl links and other short links.
- Copy the link without opening it. On a phone, press and hold the link and choose Copy.
- Open the unshorten tool and paste the link.
- Click "Show destination."
- Read the result: each redirect step with its HTTP status code, then the final address in full.
The tool requests only the headers each server sends back. It does not load the page, nothing runs on your device, and your browser never goes to the destination. That matters, because some malicious pages try to do damage the moment they load.
What the status codes mean
You will see numbers next to each hop. A 301 or 308 means a permanent redirect. A 302 or 307 means a temporary one. A 200 means the chain ended at a normal page. You do not need to memorize these. The useful part is the final address and how many hops it took to get there.
A worked example
Say you get a text: "Your package is held. Confirm delivery: bit.ly/4kLm2Qp." You paste that into the tool. Suppose the result shows two hops and ends at usps-redelivery-confirm.example-site.top. The real USPS site is usps.com. This address is a different domain with "usps" only in the name. Do not open it. That is a mismatch, and it is your answer.
Now suppose a coworker sends a bit.ly link and the tool shows it ends at a Google Docs address on docs.google.com. The domain matches what they said it was. That is far more reassuring, though still not a guarantee about the specific document.
Method 2: Add a plus sign to the end of the bit.ly link
Bitly has a built-in preview. Add a + to the end of the short link and open it in your browser. For example, bit.ly/Wn2Xdz becomes bit.ly/Wn2Xdz+. Instead of redirecting you, Bitly shows a page on its own site that lists the destination URL and the title of that page, as described in this walkthrough and in guidance from Innovations for Poverty Action.
This is quick when it works, but keep three limits in mind:
- It is a Bitly feature, and Bitly can change or remove it. If it does not work for you, use Method 1.
- It may not work on links that use a custom branded domain instead of bit.ly. If the link is not on bit.ly, the trick is not guaranteed.
- You are typing a modified URL into your browser. A typo could send you somewhere else, so copy and paste rather than retyping.
Method 3: Check it on the page where you found it
Sometimes you can learn a lot before touching the link at all.
- Desktop email or web: hover over the link and look at the bottom-left corner of the browser. For a short link it will only show the short address, so this tells you the shortener, not the destination. It does at least catch a link that claims to be one thing but points at another.
- Ask the sender. If a friend or coworker sent it, message them on a different channel and ask what it is. If their account was hacked, a quick "did you send this?" is the best test there is.
- Go to the source directly. If the message says it is from your bank or a delivery service, skip the link. Open the company's app or type its known website yourself.
What to look for in the final address
Once you have the full destination, read the domain, which is the part right before the first single slash. Most of the signal is there.
- Look-alike names. paypa1.com (with a number one) or amazon-support-help.com are not the real sites. The real brand name has to be the actual domain, not just a word somewhere in the address.
- Odd endings. A familiar brand on an unusual ending such as .top, .xyz or .click deserves a second look. Plenty of legitimate sites use those too, so treat it as a prompt to be careful, not as proof.
- Long chains of redirects. One or two hops is normal. Many hops through unrelated domains is a reason to stop.
- Requests for logins, payment, or codes. If the page you would land on wants a password, card number, or a verification code, the stakes go up. Verify through another channel first.
- No https. A destination that starts with http instead of https is a warning sign today, though https alone does not make a site trustworthy.
What these checks cannot tell you
Being honest about limits makes the checks more useful, so here they are.
Expanding a link shows you where it goes. It does not prove the page is safe. A scammer can host a convincing fake on a clean-looking domain, and a compromised legitimate site can serve harmful content. Reading the domain filters out the obvious cases, not every case.
Some links also cannot be expanded. Our tool cannot check private or internal addresses, links that require a login, or sites that block automated visitors. When that happens, the result tells you what stopped the check. A link behind a login is not automatically bad, but you also cannot confirm it from the outside. Treat that as "unknown" and verify with the sender.
Finally, a link can behave differently over time. A destination that looks fine today can be changed later by whoever controls it. If you are going to act on a link days after you checked it, check it again.
What to do if the link looks wrong
- Do not open it. Do not reply to the message either.
- Report it. The FTC says to forward phishing texts to 7726 (SPAM) and to report phishing attempts at ReportFraud.ftc.gov. Phishing emails can be forwarded to [email protected].
- Delete the message.
- If you already clicked, do not enter anything on the page. If you did enter a password, change it on the real site right away and turn on two-step verification.
Our post on how to shorten a URL also explains why link-shortening services are used by honest and dishonest senders alike, which is useful background.
If you send short links yourself
The reverse problem exists too. If you share links with customers or followers, people will hesitate to click a bare short link, and they are right to. A link on your own domain, such as go.yourbrand.com/offer, shows who is behind it before anyone clicks. Our guide to creating a branded short link and the step-by-step on using your own domain for short links cover how to set this up. A branded link will not make a bad message trustworthy, but it removes one reason for a reader to be suspicious of a good one.
FAQ
Can I see where a bit.ly link goes without clicking it?
Yes. Paste it into an unshorten tool, which follows the redirects from a server and shows you the final address. You can also add a plus sign to the end of a bit.ly link to open Bitly's own preview page, though that is a Bitly feature that may change.
Does adding a plus sign to a bit.ly link work on every short link?
No. It is specific to Bitly, and it may not work on links that use a custom domain. For other shorteners such as t.co, use an unshorten tool.
Is a bit.ly link safe if the destination uses https?
Not necessarily. https means the connection is encrypted, not that the site is honest. Scam sites commonly use https. Judge the domain, not just the padlock.
What should I do if I already clicked a suspicious short link?
Close the page without entering anything. If you typed a password, change it on the real site and turn on two-step verification. Then report the message to the FTC at ReportFraud.ftc.gov and forward phishing texts to 7726.
Frequently asked questions
Can I see where a bit.ly link goes without clicking it?
Yes. Paste it into an unshorten tool, which follows the redirects from a server and shows you the final address. You can also add a plus sign to the end of a bit.ly link to open Bitly's own preview page, though that is a Bitly feature that may change.
Does adding a plus sign to a bit.ly link work on every short link?
No. It is specific to Bitly, and it may not work on links that use a custom domain. For other shorteners such as t.co, use an unshorten tool.
Is a bit.ly link safe if the destination uses https?
Not necessarily. https means the connection is encrypted, not that the site is honest. Scam sites commonly use https. Judge the domain, not just the padlock.
What should I do if I already clicked a suspicious short link?
Close the page without entering anything. If you typed a password, change it on the real site and turn on two-step verification. Then report the message to the FTC at ReportFraud.ftc.gov and forward phishing texts to 7726.