Free redirect tool
Short URL Expander
Paste a shortened link to reveal its real destination without opening it. TrueURL follows every redirect on Cloudflare's network, so your browser never touches the link.
Press Enter to check
Cloudflare's edge always validates certificates, so this cannot skip the check. Certificate problems are reported in the result.
Sent with the first request, up to 16 KB. JSON bodies are sent as application/json, others as a form, unless you set a Content-Type header.
1 to 50. Browsers stop after 20.
Sites can redirect phones, crawlers and link preview bots differently.
Sent with every request in the chain.
No custom headers.
Enter a value to send this header. Header values are never saved.
Follow <meta http-equiv="refresh"> tags and Refresh headers found in HTML pages.
Follow simple, unconditional redirects such as location.href = "…" in page scripts.
Settings are remembered in this browser. Cookies, header values and the POST body are never saved.
How to unshorten a link
Paste the short URL and press Check. TrueURL requests it from Cloudflare's network, follows each redirect, including the extra tracking hops many shorteners add, and shows you the final URL. Copy the destination, or open it once you're happy with where it goes. This works for bit.ly, t.co, tinyurl.com, ow.ly, is.gd, buff.ly, rebrand.ly and branded short domains alike.
On a phone, press and hold the link in an email or message and choose Copy link instead of tapping it, then paste it here.
How to tell if the destination is safe
Expanding a link tells you where it goes, not whether that site is trustworthy. Before opening it, check:
- The real domain: read the host name (between
//and the next/) from right to left. Inhttps://paypal.com.secure-login.example/signin, the domain issecure-login.example, not PayPal. - Look-alike spelling: swapped or extra letters, digits instead of letters (
paypa1), letter pairs that look like another letter (rnicrosoft) and unusual domain endings. - The route: several unrelated domains in a row can be normal for ad tracking, but they are also typical of scam traffic.
- What the page wants: a link from a message shouldn't land on a page asking for a password, payment details or an unexpected download.
TrueURL also points out warning signs it can see in the result, such as a destination that isn't HTTPS, an IP address or punycode host name, an unusual port or a file download. If in doubt, don't open it. You can also look up the final URL in a reputation service such as Google Safe Browsing.
What you'll see in the expanded result
- The final URL, often with tracking parameters such as
utm_source,fbclidor an affiliate ID. They rarely change the page itself, and you can usually remove them before sharing the link. - Every intermediate hop: shorteners often redirect through their own tracking domain or through a second shortener before the destination.
- Client-side redirects: some services, t.co among them, answer browsers with an HTML page that redirects by JavaScript or meta refresh instead of a plain HTTP redirect. TrueURL detects these and labels them.
- Interstitial and challenge pages: if a shortener shows an ad, a warning or a CAPTCHA before redirecting, the chain stops there, and TrueURL marks pages that look like a bot check.
Why a short link can lead to different places
Some link services route the same short link differently depending on the visitor's country, device or the time of day, and some rotate between several destinations. TrueURL shows the route for a request from Cloudflare's network with the User-Agent you choose. To see where phone users go, pick an iPhone or Android preset in Advanced Settings, or compare both at once with the Mobile vs Desktop Redirect Checker.
Frequently asked questions
Is it safe to expand a short URL with TrueURL?
Yes. The link is requested by TrueURL's checker on Cloudflare's servers, not by your browser, so nothing from the destination runs on your device. Only the URLs, status codes, headers and a few page details, such as the title, come back to you.
Does expanding a link count as a click?
It can. TrueURL's request reaches the shortener just as a click would, so the link owner's statistics may count it, although many services filter out automated traffic. The request comes from Cloudflare's network, and TrueURL doesn't pass on your IP address or your browser's cookies.
Why does the link end on a login, consent or "Just a moment" page?
The destination or the shortener is asking for something an automated request can't provide: a sign-in, a cookie consent choice or a bot check. TrueURL shows that page's URL and marks likely bot challenges. The URL itself often reveals the real target in a parameter such as continue=, next= or redirect_uri=.
What do utm_ and other parameters in the final URL mean?
They are tracking tags. utm_source, utm_medium and utm_campaign tell the site's analytics where the click came from, fbclid and gclid are click IDs from Facebook and Google Ads, and parameters like ref or aff often carry an affiliate ID.
Can I expand a link from a QR code?
Yes. Most phone cameras show the link when they recognise a QR code. Copy it instead of opening it, paste it here and check where it leads. This is worth doing for codes on parking meters, flyers and stickers, which are a favourite place for fake QR codes.
What happens if a short link has expired or been disabled?
The shortener usually answers with a 404 Not Found or its own warning page instead of a redirect. TrueURL shows that response as the final hop, so you know the link is dead before you share it.