How to check where a short link goes before you open it
The whole function of a short link is that it hides the destination, so the usual advice to read the URL before clicking does not apply. There are still reliable ways to resolve one without loading the page. Here is what works, what does not, and why an unfurled preview in a chat app is not the same as knowing where a link points.
The standard advice about suspicious links is to read the URL before you click. With a short link there is nothing to read. Twenty-two characters, an opaque slug, and no indication of whether it lands on a documentation page or a credential harvester wearing your bank's colors.
That is not a flaw in a particular service. Concealment is what shortening does. So the question is narrower and more practical: how do you resolve the destination without letting the destination reach your browser?
What actually works
1. Let a command line follow it
The most reliable method needs no third party. On macOS, Linux, or Windows with curl available:
curl -sIL "https://forwrd.us/abc123"
This sends HEAD requests, follows redirects, and prints each response's status line and headers. You get the whole chain: the 301 or 302, each Location header, and the final URL. No HTML is rendered, no JavaScript runs, and no page assets load. Drop the -L to see only the first hop.
Two caveats. Your IP address still touches the redirector and the destination server, so this is not anonymity, only isolation. And some hostile sites serve different responses to non-browser user agents, so a clean chain is not a certificate of safety.
2. Use the shortener's own preview
Where a shortener exposes a preview page, that is the cheapest option: it resolves the mapping server-side without fetching the destination at all. On forwrd.us, every link has a preview at /p/<slug> that shows the destination URL, when the link was created, and whether it has been blocked by our abuse screening. You can share a preview link instead of the direct one when you want the reader to decide with their eyes open.
3. Third-party expanders, with an asterisk
Expander sites and browser extensions resolve the chain for you and often add reputation data. They work. They also learn the link, the timestamp, and the fact that you were suspicious, and an extension that can rewrite links on every page you visit is a large amount of trust. If you use one, prefer a service that documents its retention, and do not paste links that are themselves sensitive, such as password reset or one-time invite URLs.
4. Long-press on a phone
On iOS and Android, long-pressing a link shows the target URL in the preview sheet and offers Copy. That gets you the short URL, not the destination, so pair it with method one or two on a computer. For a QR code, most camera apps show the URL in an overlay before you tap through; read the whole domain there rather than the first few characters. More on that in the QR code piece.
What does not work
- Trusting the shortener's domain. A well-known redirect domain says nothing about the destination. That is the entire reason phishing uses shorteners.
- Trusting a chat app's unfurl. Those cards are Open Graph tags served to a crawler, and a page can serve the crawler one thing and you another.
- Opening it in a private window. Private browsing changes what is stored locally, not what the page can do while it is open, and not what the server learns.
- The plus-suffix trick. It was never standardized, support has been inconsistent for years, and when it fails you have followed the link.
Reading the destination once you have it
The final URL is only useful if you read it correctly.
- Find the registrable domain, which is the part immediately left of the public suffix. In
login.example.com.attacker.net/verifythe site isattacker.net, notexample.com. - Watch for lookalike characters and hyphenated variants of a brand name, plus subdomains arranged to put a familiar word first.
- Note what the page asks for. A credential form or a file download reached through a concealed link deserves a hard stop, regardless of how legitimate the domain looks.
- When the link claims to come from a service you use, close it and reach the service the way you normally would. Typing the domain yourself defeats every redirect trick at once.
The part that is our responsibility
Screening belongs on the operator, not only on the reader. Destinations submitted to forwrd.us are checked when the link is created, reported links are reviewed by a human, and a blocked link stops resolving instead of forwarding. Our service guidelines spell out what gets a link removed: phishing, malware, and destinations designed to deceive the person clicking.
Screening catches known-bad and obvious-bad. It does not catch a clean page that turns hostile a week after we looked at it, and any shortener claiming otherwise is overselling. That gap is why the resolve-before-you-open habit is worth keeping. Our end of the deal, including what a click does and does not record, is documented in what forwrd.us logs when someone clicks.
Frequently asked
How do I see where a short link goes without clicking it?
Ask something other than your browser to follow the redirect. On a computer, a single command such as curl -sIL <url> prints the redirect chain and the final Location header without rendering the page. Many shorteners also expose a preview: forwrd.us shows the destination at /p/<slug>. Third-party expander sites work too, but they see the link and the fact that you checked it, so they are a privacy trade rather than a free lunch.
Does adding a plus sign to a short link still show a preview?
Sometimes, and you should not rely on it. Appending + or a similar suffix was a convention on several 2010s shorteners including bit.ly, and support has been inconsistent and undocumented since. If it works you get a stats or preview page; if it does not, some services simply follow the redirect, which means you have opened the link you were trying to avoid.
Is the link preview my chat app shows me trustworthy?
Only partly. The unfurl was produced by the platform's own crawler fetching the page and reading its Open Graph tags, so the title and image are values the destination chose to serve to a bot. A page can serve one set of tags to the crawler and different content to a human, and cloaking on user agent or IP is a standard technique. Treat an unfurl as a hint about the destination, not as proof of it.
Is a redirect chain a red flag by itself?
Not always. Chains happen for mundane reasons: HTTP to HTTPS, a bare domain to www, a shortener to a campaign URL to a localized path. What deserves attention is a chain that ends on a login form for a service you did not expect, that crosses to a lookalike domain, or that ends in a download. Read the final domain character by character, especially where a lookalike character could be substituted.
Related reading
QR codes are short links printed as pixels
A QR code is not a technology for trust. It is a machine-readable string with no human-readable preview, which is exactly why quishing works on people who would never click the same URL in an email. Here is what a QR code actually encodes, why the phone camera layer is where the risk lives, and how to publish one without turning it into a permanent dependency on a company staying alive.
13 min readExpiring links and click limits: when a short link should stop working
Most short links are immortal by default, which is the wrong default for a one-time invite, a password reset handoff, a webinar seat, or a document you only meant one person to open. Expiry dates and click caps are a small feature with real security value, and a few sharp edges worth knowing before you rely on them.
11 min readWhat forwrd.us logs when someone clicks your link
Every shortener sits in the path of every click, which makes it an analytics checkpoint whether it advertises itself as one or not. Rather than write another piece about other people's logging, here is ours: what a click writes to our database, what it does not, what our hosting layer sees before our code runs, how long any of it lives, and which parts we cannot promise away.
12 min read