How we keep short links safe
Short links hide the address until you tap them. That’s useful, and it’s also exactly what scammers like. Here’s what we do about it.
Last updated 17 October 2026
What you can’t use our short links for
- Phishing. Pages that ask for passwords, card numbers or account details while pretending to be someone else.
- Malware. Anything that downloads or installs harmful software.
- Scams and fraud. Fake shops, fake prizes, fake investment offers, fake support lines.
- Pretending to be a brand, a bank or a government office. That includes custom back-halves like
/paypal-verify, which we refuse when you type them. - Spam. Links sent in bulk to people who didn’t ask for them.
- Hiding a link to get past a filter. Using a short link so an email or chat filter can’t see where it really goes.
- Illegal content, wherever you or the people opening the link are.
A link to another link shortener can’t be shortened here either. Stacking shorteners hides the real destination from every check, ours included, so shorten the final address instead.
What we check before a link goes live
When you shorten a link, we look at it before anyone else can open it:
- It has to be a normal
http://orhttps://web address on the public internet. Addresses that point into private networks, at an IP number instead of a name, or at this site’s own sign-in pages are refused. - We follow the page’s own redirects, up to 5 of them, and check every stop along the way. A link that looks harmless but bounces somewhere else is judged by where it ends up.
- We compare it with our own list of blocked sites, endings and words, which we update as we learn about new tricks.
- We look for the usual signs of a fake page: a famous brand’s name on someone else’s domain, look-alike letters from other alphabets, sign-in pages on throwaway domains, and links that download programs.
None of this is perfect, and we won’t pretend it is. A brand-new scam page may pass every check on its first day. That’s why reports matter.
What happens to a flagged link
A link that shows warning signs but isn’t known to be harmful still works, with one extra step: people who open it see a page telling them what we noticed and showing exactly where the link goes, and they decide whether to continue.
A link we know is harmful doesn’t redirect at all. Anyone who opens it sees a page saying it was removed for safety, and nobody is sent on.
A link that suddenly gets far more clicks than usual is checked again straight away. If it fails, it’s blocked automatically and a person reviews it.
How to report a link
Use the report form. Every warning page links to it too. You don’t need an account, and an email address is optional.
We read every report. When 3 different people report the same link, it’s paused straight away until we’ve looked at it, so a link sent to a lot of people doesn’t keep working while it waits for us. One person reporting a link many times counts once.
If your link was blocked
Mistakes happen, and we fix them. If a link of yours was blocked and you think it shouldn’t have been, contact us with the short link and a sentence about what the page is. We’ll look again, and if we got it wrong we’ll unblock it. Links we block are kept, not deleted, so unblocking brings them back exactly as they were.
If we keep finding harmful links from the same person, we stop them making new ones.
What we keep when someone clicks
- No cookies for counting clicks. The only cookie a short link can set is for an A/B test the link’s owner turned on, so you keep seeing the same version.
- No IP addresses. To count unique visitors we mix your address with a random value that changes every day and keep only the scrambled result. Once the day’s value is thrown away, nobody, us included, can turn it back into an address or link it to another day.
- What we do keep for each click: the time, the country (and city where our network provider supplies it), the type of device, the browser, and the website you came from.
- That detail is deleted after 90 days. After that, only daily totals remain.
- Automated visitors, such as search engines and the previews chat apps draw, are counted separately, so link owners see real people.
Questions
Ask through the contact form. The privacy policy covers the rest of the site.