How to check where a short link goes before you click it

A short link is deliberately unreadable. When one arrives from someone you were not expecting, the useful move is not to click carefully — it is to make something other than your browser go and look.

The four techniques

Add a plus sign. On gc.mw and Bitly, appending + to the link opens a preview page instead of following it: gc.mw/abcd+ shows the destination host and whether the link is active, expired or disabled, and nothing else happens. It is the fastest check that exists and it costs one keystroke.

Use the service's own preview. TinyURL has a preview page on a preview. subdomain, as of September 2026. Most large shorteners have some equivalent; almost none of them advertise it, so check the service's support pages before you assume there is none.

Expand it server-side. A link expander requests the link from its own machine, follows the redirects and reports every hop. Your browser is never involved, so no script runs, no fingerprint is taken and no cookie is set on you.

Ask the sender. Underrated. If a colleague sends a short link with no context, one message saves everyone a lot of time, and if the account has been compromised the reply itself tells you.

Reading the chain

The output is a list of hops. Each has a URL, a status code and a host. Four things are worth reading carefully.

The final host. Not the first, not the prettiest. Look at the actual registered domain at the end and ask whether it is where the message claimed to send you. secure-hdfc-verify.example.com is not a bank; the bank is the part immediately before the top-level domain.

Any hop through another shortener. A chain that goes bit.ly then cutt.ly then somewhere else is not a plumbing accident. Nesting shorteners defeats link previews and some filters, and legitimate campaigns essentially never need it.

A drop from https to http. From that hop onward the redirect can be modified by anyone on the network path. Browsers warn about it, and it usually indicates infrastructure nobody has maintained in years.

The status codes. A 301 anywhere in the chain means browsers will cache that hop; if the chain is later cleaned up, everyone who cached it keeps going to the old place. A 307 or 308 preserves the request method, which matters only when something other than a person is following the link.

The safety rules the tool follows

Anything that fetches a URL on a user's behalf is a server-side request forgery waiting to happen, so the expander is deliberately paranoid.

1. 1

   The host is validated before every hop

   Not just the URL you pasted. localhost, anything ending in .local, .internal or .home.arpa, bare names with no dot, and every private, loopback or link-local IP address are refused.

2. 2

   DNS is resolved once and pinned

   If any address a host resolves to is private, the whole hop is refused — a mixed answer is how DNS rebinding attacks begin.

3. 3

   It reads headers, not bodies

   A HEAD request first, falling back to GET only when a server refuses HEAD. Nothing downloads the page content.

4. 4

   Everything is bounded

   At most five redirects, a five-second budget for the whole chain, and no cookies or credentials ever sent.

If the chain is longer than five hops or the budget runs out, you get what was collected plus a note that it stopped. Truncation is information too: legitimate links rarely need six redirects.

After you check

If it looks wrong, report it rather than only deleting it. On gc.mw two independent reports on the same code flag it for review automatically, which is faster than any queue a human could run, and the reporter is never shown to the link's owner.

If it looks fine, you have also learned something useful about your own links: run one of your own campaign links through the same tool. The number of businesses that discover their own landing page has been quietly 302-ing through a retired marketing platform for two years is higher than you would expect.