Link Expander: Where Does This Link Really Go?
Paste a short link, a link from a text message or email, or the address behind a QR code. We follow every redirect on our server, not on your device, and show you where it really ends, plus the warning signs worth knowing about before you tap it.
Nothing opens on your device and nothing is stored. One catch: some scam links are made for one person, and checking one may tell the sender it was opened, from our server’s address rather than yours.
Every step, in order
How to Read the Result
The coloured box gives the overall picture, the list under it explains each warning sign we found, and “Every step” shows the whole journey: each address the link passed through, how it moved on (a redirect, or a refresh written into the page), and where it stopped. A link that goes straight to its destination has one step. Short links have at least two.
| Warning sign | Why it matters |
|---|---|
| A brand-new domain | Scam sites are usually registered days before the messages go out. A bank or delivery company you’ve used for years isn’t on a domain registered last week. |
| A brand name in the wrong place | In paypal.account-check.example, the site is account-check.example. The brand name in front is decoration anyone can add. |
| An “@” in the link | Browsers ignore everything before the @, so https://paypal.com@example.net goes to example.net. |
| Unusual letters (xn--) | The domain uses characters from other alphabets, sometimes to imitate a familiar name. Check it with our lookalike domain checker. |
| A free website platform | Anyone can publish a page on these in minutes. The platform is legitimate; the page on it may not be. |
| A file download | A link from a text that ends in an app (.apk) or a program (.exe) is a classic way to install malware. Don’t open it. |
| No HTTPS, or a broken certificate | Never type a password or card number into a page like this. |
Tricks Scam Links Use
Shorteners hide the destination
Services like bit.ly and tinyurl are used by honest companies every day, which is exactly why scammers like them too: the short link says nothing about where it leads. Expanding it first takes ten seconds.
Several hops in a row
Some scam links bounce through a chain of addresses: a shortener, then a tracking server, then a hijacked website, then the real page. Each hop makes the link harder for filters to judge. A long chain isn’t proof of a scam, because advertising links do it too, but it’s a reason to look at where it ends.
Old domains, new tricks
A legitimate-looking domain can still carry a scam page: a hacked small-business website, or a page on a free hosting platform. Age and HTTPS are useful signals, not guarantees. Read the domain the way our free lesson Read a Link Before You Tap teaches: the real site is the name just before the first single slash, read from the right.
QR codes
A QR code is just a link you can’t read. Scan it with our QR code decoder to get the address without opening it, then paste that address here to see where it leads.
What This Check Can’t Tell You
- Whether the final page is safe. We look at the link, the domain and the connection, not the page’s content, and we don’t scan for malware. A clean result means none of the common warning signs, not a guarantee.
- Redirects done in JavaScript. We never run a page’s code, so if a page sends you on with a script, we stop at that page and say so.
- What other people see. Some scam sites show a harmless page to anything that looks like a checker, or only work in certain countries. We fetch links the way a phone browser would, but a site can still show us something different.
Is It Safe to Check a Link Here?
Yes, and it’s safer than tapping it. The link is followed by our server, which only reads each response’s status and headers. It never opens the page in a browser, never runs its scripts and never saves its files, so there’s nothing for a malicious page to attack. Your device never connects to the link at all. We refuse to follow links into private or internal network addresses, and we don’t keep a record of the links you check.
Frequently Asked Questions
How do I see where a short link goes without clicking it?
Paste it into the box above. We follow it on our server and show every step and the final address. Many shorteners also have their own preview: adding a + to the end of a bit.ly link, for example, shows its destination on bit.ly’s own page.
I already clicked a suspicious link. What now?
If you only opened the page, close it. Don’t enter anything, and don’t install anything it offers. If you typed a password, change it now, on the real site, and turn on two-factor sign-in. If you entered card details, call your bank. Our free lesson If You’ve Been Scammed walks through the first hour.
Why does my link stop at “a private or reserved address”?
The link, or one of its redirects, points at an address that only exists inside a private network. Legitimate public links never do that, so we stop rather than follow it.
The result says the final page doesn’t exist. Is the link safe?
Not necessarily. Scam pages are often taken down quickly, or work only for a few hours or a few visitors. A dead page today could be a live one tomorrow. Treat the message as a scam if the other signs point that way.
Do you keep the links I check?
No. The link goes to our server, is followed, and the result comes back to your browser. It isn’t written to a log or a database. The only thing we keep is a counter of how many checks your address made in the last minute, to stop abuse.