Are short links safe?
Short links are everywhere, from text messages to posters. Most are harmless, but they hide where they go, which is exactly why scammers like them.
Link shorteners such as bit.ly, TinyURL and t.co turn a long address into a short one. When you tap the short link, the shortener's server sends you on to the real address. That's handy for social posts and printed flyers. The catch is that you can't see the destination until you've already gone there.
Why scammers use them
- They hide the real domain. All the checks in our phishing link guide depend on reading the domain. A short link takes that away.
- They borrow a clean reputation. Email and SMS filters are slower to block well-known shortener domains than brand-new scam domains.
- They can be changed later. Some services let the owner change where a link points after it's been shared.
How to preview a short link without opening it
Several shorteners offer a preview page that shows the destination first:
- Bitly: add a
+to the end, for examplebit.ly/abc123+, to see the link's info page. - TinyURL: add
preview.to the front, for examplepreview.tinyurl.com/abc123. - Anything else: ask the person who sent it for the full address. Someone with nothing to hide won't mind.
Once you have the full address, paste it into SafeToHop to check it properly.
QR codes are short links too
A QR code is just a link you can't read. Scammers stick fake QR codes over real ones on parking meters, restaurant tables and posters. Most phone cameras show the address before opening it, so take a second to read it. If it's a short link or a domain that doesn't match the business, don't open it.
When short links are usually fine
A short link is lower risk when it comes from someone you know, through a channel you expected, about something you asked for. Big companies also use their own branded short domains, such as amzn.to for Amazon or youtu.be for YouTube.
Be extra careful when a short link: arrives by text from an unknown number, claims to be from a bank, delivery firm or tax office, or asks you to pay a small fee or confirm details.
Why SafeToHop warns about short links
SafeToHop reads links without opening them. That keeps you safe while you check, but it means we can't follow a short link to its destination. Instead, the scan flags it as a warning and lowers the score, so you know to get the full address before you trust it.
Not sure about a link?
Paste it into SafeToHop. We read the address without opening it.