Short links are not dangerous in themselves, but they hide the real destination, which scammers can exploit. A short link is safe to open when you trust the sender and can see where it leads. Before clicking, preview the destination with an expander or scanner tool and check that the final domain is the one you expect.
Short links are everywhere: in text messages, social media posts, emails and behind QR codes. This guide explains how they work, why criminals like them, and simple ways to check a short URL before you open it.
How short links work
A link shortener takes a long web address and gives you a short one, such as a domain followed by a few letters and numbers. When someone opens the short link, the shortener's server looks up the original address and forwards the visitor there. This forwarding is called a redirect.
People use short links because they:
- Fit neatly in text messages, posts and printed materials.
- Look tidier than long addresses full of tracking parameters.
- Can be counted, so the owner sees how many people clicked.
- Can sometimes be edited later, which is how dynamic QR codes work.
None of this is harmful. The risk comes from one side effect: you cannot see the destination by reading the link.
Why scammers like short links
Because a short link hides where it goes, it can disguise a phishing page as something innocent. A message that says "Your parcel is waiting, confirm here" followed by a short link gives you no clue whether it leads to a real courier or to a fake form that steals card details.
Short links can also be chained, with one redirect leading to another, which makes the final destination harder to trace. And because they are short, they are easy to put inside QR codes, which hide the address even further.
That said, reputable shorteners actively fight abuse. Many check links against malware and phishing lists and remove harmful ones. The problem is that a brand-new scam link may not be on any list yet, so your own judgement still matters.
How to preview where a short link goes
You do not have to click a short link to find out where it leads. Try one of these methods:
- Use a link expander or preview tool. These tools follow the redirect for you and show the final address without opening the page in your browser.
- Check whether the shortener offers its own preview. Some link shorteners provide a preview or information page showing the destination before you continue.
- Long-press the link on your phone. On many phones, pressing and holding a link shows a menu with the address, and sometimes a preview, without opening it fully. With a short link this only shows the short address, but it confirms which shortener is used.
- Scan QR codes with a scanner that shows the link first. Our online QR scanner reads the code in your browser and displays the destination before you decide to open it.
- Look for a loading or preview page. Short links created with QR-TH show visitors a loading page with the destination before opening it, so people can see where they are going.
What to check in the final address
Once you can see the real destination, take ten seconds to check it:
- The domain name. Look at the part just before the first single slash, for example example.com in https://www.example.com/page. That is who owns the page.
- Spelling. Fake sites often use small changes such as swapped letters, extra words or numbers in place of letters.
- Unusual endings. A real bank or courier normally uses its own familiar domain, not an unrelated one with the brand name squeezed into it.
- HTTPS. A padlock means the connection is encrypted, but scam sites can use HTTPS too. It does not prove a site is genuine.
- What the page asks for. Be very careful if the page immediately wants a login, card number, one-time code or an app download.
When in doubt, do not use the link at all. Open your browser and type the company's address yourself, or use its official app.
Red flags around the link
The message that carries the short link often gives the scam away before you even preview it:
- Urgent language such as "act now", "account suspended" or "final notice".
- A prize, refund or delivery you were not expecting.
- A sender you do not know, or a familiar name with a strange number or email address.
- Requests to move the conversation to another app.
- A link where you would normally expect none, such as a bank asking you to log in by text message.
If several of these appear together, treat the link as unsafe. Our article on QR code scams covers the same tricks used with QR codes.
How to share short links people trust
If you are a business or creator, you want people to feel confident clicking your links. A few habits help:
- Use a reputable shortener that checks links for abuse. Every link made with the QR-TH link shortener is checked against Google Safe Browsing and re-checked nightly.
- Tell people what the link is for in the same message, for example "Here is our new menu" followed by the link.
- Use the same shortener consistently, so customers recognise your links.
- Avoid sending short links in messages that also ask for passwords or payments.
- Where possible, let visitors see the destination before it opens.
FAQ
Can a short link give my phone a virus?
Simply opening a link rarely infects a fully updated phone, but the page it leads to may try to trick you into downloading an app or entering details. Keep your phone updated and never install apps from links in messages.
How can I see where a short link goes without clicking it?
Use a link expander or preview tool, or a shortener's own preview page if it offers one. For QR codes, use a scanner that shows the destination before opening it.
Are short links from big companies safe?
Links from a company you trust, sent through its official channels, are generally fine. The risk is that scammers can create short links too, so always check the sender and the final domain.
Why do businesses use short links at all?
They are tidy, fit in texts and QR codes, can count clicks and can sometimes be updated later without changing the printed link.
Short links are a useful tool, as long as people can see where they lead. Check suspicious codes with the QR-TH online QR scanner, and when you share links yourself, create them with the link shortener so every visitor sees the destination first.