How To Check A Shortened Link Before Clicking It
See the full address behind bit.ly and TinyURL links and scan it for problems before you tap a prize message.
A shortened link is a short address that redirects to a longer address, so check it by revealing that longer address first. Paste it into a server-side expander, then check the revealed address with a URL scanner before you visit it. Prize posts, texts, and emails often use short links to save space.
According to CISA, criminals use shortening services to hide the true destination, and a preview address that does not match the link text may be spoofed, as explained in CISA guidance on social engineering and phishing.
Verification note: Program terms and availability can change. This page was checked against linked sources on November 03, 2026.
Why short links need a second look
A short link hides the domain, path, and file name until you expand it. You cannot judge safety from bit.ly, t.co, or tinyurl.com alone because the visible part names the shortener, not the endpoint. The Federal Trade Commission advises not opening links in unexpected emails or texts.
Contact the company through a website or phone number you already know is real instead.
How do you expand a link without opening it?
Use a server-side expander that fetches the redirect chain for you. The University of Michigan Safe Computing group says you can paste a bit.ly, t.co, or tinyurl.com address into an expander to see the full destination and redirects without loading it, as described in University guidance on shortened URL security.
- Copy the short link without tapping or clicking it.
- Paste it into the expander box and submit it.
- Read the full destination and each redirect step.
- Stop if the endpoint looks unrelated to the claimed sender or prize.
What do Bitly and TinyURL previews show?
For a Bitly address, add a plus sign to the end, such as bit.ly/abc123+. The University of Michigan Safe Computing group says this opens an info page with the destination URL, title, creation date, and click data without redirecting you. For a TinyURL address, add preview before the domain or use the preview setting.
TinyURL says that preview page shows the long destination before any redirect, though it requires browser cookies, as shown on TinyURL information about preview mode.
How do you check the full address?
After expansion, paste the long address into Google Safe Browsing Site Status. According to Google, the checker reports whether Google has flagged the address for phishing, malware, or unsafe content, as shown in Google Safe Browsing site status. For a second opinion, paste the same expanded address into the URL tab at VirusTotal.
VirusTotal says it scans the address with more than 70 antivirus and blocklist engines and returns a detection ratio.
What should you do on a phone?
On mobile, press and hold the link to preview the address without opening it. Compare that preview with the sender name, claimed store, and any prize details in the message. A clean expander or scanner result does not prove safety because new or cloaked sites may be unlisted.
Forward suspicious texts to 7726, labeled SPAM, and report them to ReportFraud.ftc.gov, as the Federal Trade Commission advises.