You’ve probably seen them: a short link in a message, a text, an email, a
comment thread. Something like bit.ly/x4Tg9 or redirme.com/abc123. Short
links are useful because they fit in tweets, they’re easier to read aloud, they
don’t break when you paste them. But they share one uncomfortable feature: you can’t see where they go until you click.
For most short links, that’s fine. The sender is a friend, a brand you trust, or a colleague forwarding a news article. The same property that makes them convenient, though, also makes them an attacker’s favourite envelope. A short link can hide a phishing page that looks identical to your bank’s login, a fake “delivery failed” form harvesting your address, or a download that installs something unpleasant. In the past few weeks alone, we’ve removed thousands of short links from RedirMe that were pointing to phishing kits, fake delivery scams, and dubious affiliate funnels. We’re not unique, every shortener fights this constantly.
The good news: checking a short link before you click takes about five seconds. Here’s how.
The + trick
The simplest way to preview a RedirMe link is to add a plus sign to the end.
Take the link you want to inspect, say redirme.com/abc123 and type it into your browser’s address bar as redirme.com/abc123+. Instead of being whisked off to the destination, you’ll land on a page that shows you exactly where the link goes, when it was created, and a screenshot of the destination as we last saw it.
A few other shorteners have similar preview features. The convention varies,
some use a plus sign too, some use a preview. subdomain, some require you to log in. If there’s a shortener you encounter a lot, it’s worth a five-minute look at their documentation.
But there’s a more universal answer: a tool that works on any short link, from any shortener, including links that aren’t technically shortened but still bounce you through several redirects.
Use the checker
We’ve built a free public checker at redirme.com/check. Paste any URL and it does the work for you:
- Follows every redirect, hop by hop, and shows you the full chain
- Tells you the final destination
- Shows whether each hop uses HTTPS
- Tags any hop that belongs to a known link-shortening service
- Runs the final destination through Google Safe Browsing
It’s free, you don’t need an account, and we don’t log the URLs you check. The whole point of a tool like this is privacy, logging what you check would defeat the purpose.
The checker works on bit.ly, tinyurl.com, t.co, ow.ly, buff.ly, and anything else that redirects. If a URL goes somewhere, we’ll follow it for you and show you where it leads.
What to look out for
A few patterns are worth recognising, whether you’re inspecting links by hand or reading the checker’s output.
Multiple shorteners in a chain. A normal short link usually has one hop: the shortener, then the destination. If you see a chain like bit.ly → tinyurl.com → cutt.ly → some unfamiliar domain, someone is going to obvious trouble to make tracing the link harder. That’s an evasion pattern, and a strong signal to walk away.
A domain that looks almost right. Phishing trades on misreading. paypa1.com (with a one instead of an L), microsoft-support.co, apple.id-verify.net. If the final destination is supposed to be a brand you know, look at the registered domain, that is the part just before the last dot. verify.apple.com is Apple. apple.verify-account.com is not.
HTTP instead of HTTPS at the end. Most legitimate sites have used HTTPS for years. A final destination served over plain http:// is a red flag, especially if it’s asking for credentials or payment details.
Mismatched context. Your bank doesn’t send you links via bit.ly. Your courier doesn’t send tracking through a free shortener. Real businesses use their own domains for important things. A “DHL” notification arriving as a tinyurl link is almost certainly not from DHL.
Urgency. “Your account will be closed in 24 hours.” “Unusual sign-in detected, verify now.” Urgency is the oldest trick in the phishing playbook, because urgency is what stops you from doing exactly what this article is asking you to do.
What we do on our end
A safety tool is most useful when you can trust the platform behind it. A quick word on RedirMe specifically:
- New links are run through Google Web Risk as part of our verification process, and we re-check links over time.
- We block new links pointing to destinations on our internal abuse list, which we maintain from Web Risk verdicts, user reports, and our own monitoring.
- We monitor for abuse patterns and disable suspicious links quickly, often before they get any meaningful traffic.
- We don’t expire links. A safety check that disappears in thirty days isn’t really a safety check. RedirMe links are permanent, which means our verification has to be permanent too.
We don’t catch everything. Nobody does. But the combination of automated checks, ongoing monitoring, and a clear reporting path means most malicious links don’t last long on our platform. In case you see anything suspiscious, don’t hesitate to report the link.
The five-second habit
If you take one thing from this article: before you click a short link from anyone you don’t completely trust, paste it into redirme.com/check first. Or, if it’s a RedirMe link, add a + to the end and let our preview page do the work.
It costs you nothing, it takes five seconds, and it’s the difference between arriving where you meant to go and arriving where someone else wanted to send you.