Question 1

How do URL shorteners actually work?

Accepted Answer

**A shortener stores a mapping** from a short code (e.g., `bit.ly/3xyz`) to a long URL (`https://example.com/some/very/long/path?with=params`). When a browser requests the short URL, the shortener's server returns an HTTP redirect (usually `301 Moved Permanently` or `302 Found`) with a `Location:` header pointing to the long URL. The browser follows the redirect automatically. **Some shorteners chain**: `bit.ly` → custom tracker → `t.co` → final URL, each hop is a separate redirect, often each with tracking analytics. **The redirect can change at any time**: the shortener's owner can update the mapping, so a previously-safe short link can become malicious overnight. Major shorteners (bit.ly, t.co, tinyurl, goo.gl until shutdown, lnkd.in) are operated by reputable companies; obscure shorteners can be operated by anyone.

Question 2

Why expand a URL before clicking it?

Accepted Answer

**Three reasons. (1) Phishing protection**: a shortened link can hide the real destination, `bit.ly/3xyz` reveals nothing about whether it leads to a bank's real login page or a phishing clone. **(2) Avoiding tracking redirects**: marketing emails often route through tracker URLs that log who clicked what. Expanding shows you the destination so you can skip the tracker. **(3) Detecting malware / scams**: malicious links use chains of redirects to bounce through analytics filters, dynamic destinations that vary by IP/user-agent, and final landing pages on disposable domains. Seeing the chain reveals the technique. **For developers / security teams**: this tool is also useful for debugging email-template tracking pixels, OAuth redirect flows, and CDN cache misconfigurations.

Question 3

What are common redirect status codes and what do they mean?

Accepted Answer

**301 Moved Permanently**: target has permanently moved; clients can cache the new URL. SEO transfers. Used for canonical URL changes. **302 Found** (a.k.a. "temporary redirect"): target is temporary; don't cache. Used for short URLs, login redirects, A/B tests. **303 See Other**: "after POST, GET this resource", used in POST-redirect-GET patterns to avoid form re-submission. **307 Temporary Redirect**: like 302 but preserves method (POST stays POST). **308 Permanent Redirect**: like 301 but preserves method. **Meta refresh** (`<meta http-equiv="refresh">`): HTML-level redirect, slower, often used by malicious pages to evade scanners. **JavaScript redirect** (`location.href = ...`): client-side; can't be seen by simple URL-following tools. Trackers chain multiple types: 302 to clean-up endpoint, then 301 to final destination.

Question 4

What's a 'redirect loop' and how does the tool detect it?

Accepted Answer

**A redirect loop** happens when URL A redirects to B which redirects back to A (or any cycle). Browsers detect this by counting hops and aborting after ~20 redirects (Chrome) with an `ERR_TOO_MANY_REDIRECTS` error. **Common causes**: misconfigured HTTPS forcing (HTTP → HTTPS redirect rule + HTTPS → HTTP rule on same path), authentication redirects where the auth cookie isn't being set/read correctly, A/B test misconfiguration with conflicting cohort rules, mixed-content browser blocking. **The tool aborts after N hops** (typically 10-20) and reports the chain so you can see where it cycles. **For debugging your own service**: check `Location` headers at each step, verify cookie/session state between hops, and inspect server logs to see what conditions are triggering each redirect.

Question 5

Can the tool expand any URL, including links behind login?

Accepted Answer

**No.** The expander makes anonymous HTTP requests, so URLs that require authentication will redirect to a login page (or return 401/403) rather than the final intended destination. **Examples**: bank-specific email links, password reset URLs, OAuth callbacks. **Workaround**: copy the link, log into the service, paste in the browser. **Also blocked**: URLs that detect bots and serve different content to non-browsers (some news sites, social media URL previews, Facebook/LinkedIn often serve preview content to crawlers different from final destination). **For client-side / JavaScript redirects**: the tool can't follow JS-based redirects since it doesn't execute JavaScript. Truly malicious chains often use JS as a final stage. The tool shows the HTTP chain; final-stage execution requires a real browser (run in a sandbox if suspicious).

Question 6

Is the URL I'm checking sent anywhere?

Accepted Answer

The tool makes an HTTP request to the URL you provide to follow redirects, that's how URL expansion works. **The URL is sent to a backend proxy** (the page running the tool can't make cross-origin HEAD requests directly from JavaScript due to CORS). **What's NOT logged**: we don't store the URLs you check, the chains discovered, or your IP-keyed history. **What you can verify**: open DevTools Network, the page makes a single request to our expansion endpoint with your URL; the response is the chain JSON. **For maximum privacy**, use a CLI tool locally (`curl -IL <url>`) or run the request through Tor / a VPN, anything you check is at least visible to the destination server (it logs the request). The expansion itself necessarily exposes the URL to network infrastructure.

Question 7

What standards does URL Expander & Redirect Tracker validate against?

Accepted Answer

URL Expander & Redirect Tracker checks compliance with RFC 3986 (URI).

Question 8

What are the limitations of URL Expander & Redirect Tracker?

Accepted Answer

URL expansion depends on redirector service behavior Does not check if expanded URL is safe/malicious Some URL shorteners may block expansion requests

Status Code	Definition	Method Preservation	Cache Status
301	Moved Permanently	Changes to GET	Permanent Cache
302	Found (Temporary)	Changes to GET	No Cache
307	Temporary Redirect	Strict Preservation	No Cache
308	Permanent Redirect	Strict Preservation	Permanent Cache

URL Expander & Redirect Tracker

URL Expander

Learn More

AES Interoperability Across 7 Libraries: We Encrypted the Same Plaintext Everywhere and Compared Results

Base64 Encoding: When You Should and Shouldn't Use It (2026 Guide)

Bcrypt vs. Argon2 in Practice: Choosing the Right Hashing Algorithm

What is URL Expander & Redirect Tracker?

Frequently Asked Questions

Technical Deep Dive

URL Expander & Redirect Tracker

Protocol-Accurate

Diagnostic Detail

Stack-Agnostic

01 HTTP Redirect Matrix

02 Expansion Pipeline Logic

Runs 100% in your browser

You Might Also Need

Network Speed Test

Webhook Inspector & Debugger