Expand shortened URLs to reveal their final destination before clicking, with redirect chain display.
Paste a shortened URL - a bit.ly, t.co, or tinyurl.com link - and this tool follows its redirects, listing every hop and the final destination. Short links are opaque by design: the text gives no clue about the target, so the chain is the only way to see where a click would take you. The thing most people get wrong: expanding is not the same as browsing, but it is not a proxy either. The requests leave your browser with your IP, so the destination can log them, and a few links redirect differently depending on who is asking.
A concrete input and expected output from the current implementation.
Input
https://youtu.be/dQw4w9WgXcQ
Expected output
redirect: https://www.youtube.com/watch?v=dQw4w9WgXcQ
youtu.be is YouTube's own shortener and the mapping is deterministic: the path is the video ID, so the redirect target is the watch page for that ID. This particular ID is the famous 'Never Gonna Give You Up' video, which makes the result easy to verify. Depending on your region, the chain may include an extra consent or tracking hop.
The tool asks the shortener for the URL and reads the reply. A redirect answer (status 301, 302, 303, 307, or 308) carries a Location header naming the next URL; the tool records the hop - status and URL - and requests the next one, repeating until a normal 200 response arrives. Chains that bounce through an analytics service before landing are shown hop by hop, not collapsed.
The tool can only follow redirects that arrive as HTTP Location headers. Some services hide the real redirect inside the page instead - a meta refresh or JavaScript - and those stay invisible, so the last URL shown is where header-following stopped. Cloaked links serve one target to your browser and another to automated fetches, so what you see is not always what a human clicking would get.
No. It shows where the link leads, nothing more. Malicious links can end at clean-looking domains, and honest destinations can be compromised. Use the chain as evidence: compare the final hostname with the sender's real domain and be suspicious of anything unexpected. The result informs your judgment; it does not replace it.
Because that hop did not answer with a Location header. The rest of the redirect happens inside the page - a meta refresh or JavaScript - or the service needs cookies or a login before it will move on. The last URL shown is the furthest point reachable by following headers alone; your browser would have to execute the page to go further.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.