URL Expander
Paste a shortened link to see where it actually leads. Zurl follows the redirect chain and shows you the destination without opening the page.
Why short links need expanding
A short link deliberately hides its destination. That is useful — it is what makes the link short — but it also means you are asked to click something with no information about where it goes. Attackers rely on exactly this, which is why shortened links appear so often in phishing messages.
Expanding the link first restores the information a normal URL would have given you.
How to read the result
Check the domain, carefully. The destination host is the single most important piece of information. Read it character by character — paypa1.com and paypal.com differ by one glyph, and that is a deliberate technique.
Look at the chain length. One or two hops is normal. A link passing through five different domains is worth treating with suspicion.
Notice unexpected shorteners in the chain. A short link pointing at another short link is a common way of evading review.
What this tool cannot tell you
It resolves addresses. It does not evaluate reputation, and Zurl operates no malware or phishing scanner. A link can resolve to a perfectly ordinary-looking domain and still be hostile.
Context remains the strongest signal. An unexpected link in an unexpected message is suspicious regardless of where it resolves, and no expander changes that.
Inspecting the destination further
Once you have the full URL, the URL checker breaks it into its protocol, host, path and query parameters, and flags patterns like embedded credentials, punycode domains and unusual subdomain depth.
If a Zurl link is being used for something harmful, please report it — reports are reviewed and links can be disabled.
Frequently asked questions
- What does a URL expander do?
- It resolves a shortened link and shows you the address it points to, without opening the destination page. This lets you judge a link before clicking it.
- Does expanding a link open it?
- No. Zurl requests only the headers of the link, not the page content, and stops as soon as the destination is known. No scripts run and nothing is downloaded.
- Which shorteners does this work with?
- Any service that uses standard HTTP redirects, which is effectively all of them. It also resolves Zurl links directly from our own records, which is why it can tell you when a Zurl link is expired or disabled rather than just failing.
- What is a redirect chain?
- Some links pass through several redirects before reaching the final page — a shortener pointing at another shortener, or a tracking redirect in the middle. The expander shows every hop, so you can see whether a link is taking an unusual route.
- Does this tell me whether a link is safe?
- No, and this matters. It tells you where the link goes, not whether the destination is trustworthy. Zurl does not scan pages for malware or phishing. Seeing a familiar-looking domain is not proof of safety, particularly if it uses unusual characters or many subdomains.
- Why did expanding fail?
- Some sites block automated requests, some are simply offline, and some short links have expired or been removed. Zurl also refuses to follow a chain that points at a private network address, since that would let the tool be used to probe internal systems.