Are Short Links Safe? How to Check One Before Clicking

A short link is as safe as the page it leads to, and the short link hides that page. So the safe habit is to see the destination before you open a link from someone you don't know. That takes a few seconds: expand it with a command, a redirect checker, or the camera preview for a QR code.

This post has two halves: checking a short link you've received, and sending short links people can trust.

Why short links get abused

Shorteners hide the destination, which is exactly what a phishing message wants. Research has looked at this for over a decade. A study of 622 shortening services and about 25 million short URLs collected from March 2010 to April 2012 found the services' countermeasures "ineffective and trivial to bypass", although only a small share of users actually met malicious short links (Maggi et al., WWW 2013). A 2025 study of shortening services run by companies for their own domains found about a quarter open to a "misdirection" attack; the authors reported the problems and helped fix them (Zhang et al., NDSS 2025).

Check a short link before you click it

From a terminal. Ask for the headers only and read the location line:

curl -sI https://snu.to/x7Kp2 | grep -i '^location'

A redirect answers with a 3xx status and the destination in location. A 404 means the link doesn't exist or was switched off; on SendURL a 410 means it expired or reached its visit limit.

In a browser. Our free redirect checker follows every hop of a short link without opening it, and shows each status code and the final address. It doesn't rate pages. For that, paste the link into an unshortener such as unshorten.it, which shows the destination with its title and a safety rating. For bit.ly links, Bitly shows the destination if you add a + to the end of the link, and also runs a link checker (Bitly Trust Center).

Check the destination too. Once you have it, paste the domain into Google's Safe Browsing site status and look closely at the spelling.

Two things to keep in mind. Every one of these methods requests the short link, so the owner may see your check as a click: on SendURL, a curl -I request is counted like any visit. And a destination can change after you check it, if the owner edits the link.

QR codes: read the URL first

A QR code is a short link you can't see at all. Your phone's camera shows the URL before opening it; read it. The US Federal Trade Commission advises: "If you see a QR code in an unexpected place, inspect the URL before you open it", and "Don't scan a QR code in an email or text message you weren't expecting" (FTC, 6 December 2023). Watch for stickers placed over a printed code, too. On a computer, or for a code in a screenshot, our QR code scanner reads the image in your browser, shows the URL and checks where it leads before you open anything.

Sending short links people trust

• Avoid public shorteners in bulk email. Mailchimp's spam-filter advice says to "avoid link shorteners" (Mailchimp, checked 15 October 2026). In marketing email, link to your own domain and let the email tool track clicks.
• Use a descriptive slug. snu.to/oct-webinar-slides tells people what to expect; a random string doesn't. How to name short links has patterns.
• Disable instead of deleting. A deleted SendURL link frees its slug for anyone to register, so a printed or shared link could later open someone else's page. Disabling keeps the slug yours.
• Keep your own record of destinations. If a shortener ever shuts down, your list is what lets you fix old links. On SendURL, the REST API can list every link and its destination.
• Watch your clicks. A sudden spike on a quiet link is worth a look at the click list.

Checking a snu.to link

SendURL has no preview page for its links (Bitly's + trick doesn't apply). Use the curl command above, an unshortener, or our tool to check where a short link goes. Each of them counts as one click on the link. If a snu.to link leads somewhere harmful, report it on the grievance page: links found to break the rules are switched off by moderation and can't be re-enabled by their owner.

Checklist before you open a short link

• Do you know and expect the sender?
• Expand the link (curl, a redirect checker, an unshortener, or + for bit.ly) and read the destination
• Check the domain's spelling and its Safe Browsing status
• For a QR code, read the URL the camera shows before tapping
• If it asks for a password or payment, go to the site directly instead