URL Expander

Server assisted New Web Utilities

Paste a short link from bit.ly, t.co, a QR code or a message, and the Mutqan server follows its redirects one hop at a time — reading only status codes and Location headers, never the pages themselves — for up to six responses. You get the final address, each hop with its status, and plain warnings for loops, steps down from https to http, hops that could not be followed and destinations that answer with an error. Your browser never visits the link.

Privacy: The Mutqan server sends the small, fixed test requests described on this page to the host you name, and nothing is stored. Use it only against systems you are authorised to test.

How does a short link work, and how can you see where it leads without opening it?

A short link is a short URL on a shortener's domain whose server answers with an HTTP redirect — a 3xx status and a Location header naming the long address — which the browser follows on its own. Permanent redirects (301, 308) may be cached, temporary ones (302, 303, 307) are asked again on every visit (RFC 9110). To see the destination without visiting it, request the short link with redirects turned off and read each Location header in turn, as the URL Expander does.

Security note: A short link hides its destination until it is opened, which is why phishing messages use them. Expand an unexpected short link first and check the final address before you open it or type anything into the page it leads to.

How to use URL Expander

  1. Copy the short link — from a message, an e-mail, or the text your phone shows when it scans a QR code — and paste it into Short link to expand.
  2. Press Expand link. A link written without http:// or https:// is read as https://.
  3. Read Where it leads and Destination first: the final address is where a browser would land.
  4. Go through Redirect chain and Chain findings, then check the final address with the URL Safety Checker before you open it.

URL Expander features

  • Follows a short link hop by hop from the Mutqan server — your browser never opens it
  • Every response in order: its URL, its HTTP status with a plain-language meaning, and the address it redirected to
  • The final address and its status, plus the next address when the chain had to stop early
  • Warnings for redirect loops, chains longer than six responses, steps from https down to http, a final page that answers with an error, and hops that could not be followed
  • Reads status codes and Location headers only: page bodies are never downloaded, so nothing on the destination runs
  • Works with any shortener that uses standard 301, 302, 303, 307 or 308 redirects, and reads this site's own short links without counting a click

Inputs and outputs

Inputs

  • Short link to expand — any http:// or https:// address of up to 4,096 characters; without a scheme, https:// is assumed.
  • Nothing else: the requests carry no cookies, headers or data from your browser.

Outputs

  • Where it leads — the number of redirects followed, the final status, the destination host and whether the final address uses HTTPS.
  • Destination — the link as it was followed, the final address, and the next address when the chain stopped before its end.
  • Redirect chain — every response in order with its URL, status, meaning and the address it redirected to, downloadable as CSV.
  • Chain findings — loops, long chains, https-to-http steps, and hops that could not be followed or answered with an error.

URL Expander example

Expanding a link that arrived by SMS

Input:

https://bit.ly/3Spring26

Output:

Redirects followed: 2 · Final status: 200 (Success — the page answered) · Destination host: www.example.com · Final address uses HTTPS: Yes
1. https://bit.ly/3Spring26 — 301 Moved permanently → https://example.com/spring?utm_source=sms
2. https://example.com/spring?utm_source=sms — 301 Moved permanently → https://www.example.com/spring?utm_source=sms
3. https://www.example.com/spring?utm_source=sms — 200 Success — the page answered

How to read the URL Expander results

The final address is where a browser would land after the redirects: judge that host, not the shortener's.

"No redirect" means the address answered directly. It is not a short link, or the shortener answered with a page of its own (a warning page or a "link disabled" notice) instead of a redirect.

A final status of 200 means the last page answered normally. 404 or 410 means the link is broken or removed; 403, 429 or 503 can mean the site refuses automated requests, so a browser may still get through.

301 and 308 are permanent redirects, 302, 303 and 307 temporary. A shortener normally answers 301 or 302; redirects after it are usually the site's own http-to-https and www rules.

A "Next address (not followed)" means the chain stopped before reaching it — the address was refused, could not be reached, lay beyond six responses, or was named with a status browsers do not follow — and Redirects followed then reads "Next address not followed". That address is where the chain was heading; Final address and the HTTPS check describe the last address that actually answered.

When to use URL Expander

  • Checking where a short link in an unexpected SMS, e-mail or chat message leads before you tap it.
  • Verifying that your own campaign short links and QR codes point at the right page with their UTM parameters intact.
  • Finding long redirect chains, http downgrades and loops behind a short link before it goes to print.
  • Revealing where a QR code leads: copy the text your camera app shows, then expand it here.

Troubleshooting

  • "This does not look like a web address" — paste the whole link, for example https://bit.ly/abc123, without words around it.
  • "This address cannot be followed from the Mutqan server" — the link points at a private, local or reserved address, an unusual port, a workers.dev host or a page of this site. Such links cannot be expanded here.
  • "The host name of this link does not resolve" — the shortener's domain does not exist in DNS; check the spelling.
  • The chain ends on a 403, 429 or 503 — the site refuses or limits automated requests from cloud addresses. The address shown is still where the chain was heading.
  • "You have reached the per-minute limit for expanding links" — wait a minute, then try again; signing in raises the limit from about one link a minute to about ten.

Frequently asked questions about URL Expander

Is it safe to expand a link I do not trust?

Safer than clicking it: your browser does not open the link, and the Mutqan server only asks each hop for its status and Location header — it never downloads or runs the page. The shortener and every server in the chain see a request from the Mutqan server, not from you. Expanding does not tell you whether the destination is safe; check the final address with the URL Safety Checker before you open it.

Which shorteners does it work with?

Any that redirects with a standard HTTP status — 301, 302, 303, 307 or 308 — and a Location header: bit.ly, t.co, tinyurl.com, the short links of this site and most others. A shortener that first shows its own page, or redirects with JavaScript, stops the chain at that page, which then appears as the final address with a 200 status.

Why does it stop after six responses?

Each call reads at most six responses — enough for a shortener, a tracking hop and a site's own http-to-https and www redirects. When the chain is still redirecting after that, the result says so and shows the next address, which was not followed. Paste that address to continue.

Why is a hop marked "not followed"?

The next address pointed at a host the Mutqan server never contacts — a private, local or reserved address, an unusual port, a workers.dev host or a page of this site — or was not a valid URL. The chain stops there, and the address is shown so you can judge it yourself.

Does expanding count as a click on the short link?

On other shorteners, usually yes: the request reaches them like any visit, so their statistics may count it. For short links made on this site, the destination is read from the database and no click is counted.

Why can I expand only about one link a minute?

Each expansion may send up to six requests from the Mutqan server to other people's servers, and those requests share a per-minute limit that keeps the tool from being used to flood a site. Without signing in that allows about one link a minute; signed in, about ten.

Why is the final address different from the one my browser reaches?

Some sites redirect by country, language, device or sign-in, and some send visitors through a page that redirects with JavaScript. The Expander sends a plain request from the Cloudflare edge without your cookies, so it sees what an anonymous visitor arriving there would see.

Technical notes

Each hop is a GET request with redirects handled by hand and the body never read. The chain continues only on the statuses a browser follows — 301, 302, 303, 307 and 308 (RFC 9110, section 15.4, and the Fetch Standard's redirect statuses) — and only when a Location header is present; a relative Location is resolved against the URL of the hop that sent it (RFC 3986, section 5).

Before every hop the address is checked: http or https only, no user name or password, a public host whose DNS answers are all public addresses, an allowed port, not a workers.dev host and not this site (its own /s/ links excepted). A hop that fails the check is reported, never fetched.

One call reads at most six responses, waits at most 8 seconds for a hop and 20 seconds for the whole chain, and stops as soon as an address repeats (a loop). A failure on the first address is an error; a failure further along becomes a finding on the part of the chain already walked.

Each call counts as six requests against the per-minute limit on requests the Mutqan server sends on a visitor's behalf: about one call a minute without signing in, about ten when signed in, and never more than 30 a minute from one IP address. Short links of this site are read from the database without counting a click.

Limitations and methodology

Only HTTP redirects are followed. Pages that redirect with JavaScript or a meta refresh, "you are leaving this site" pages and app links stop the chain at that page.

The requests come from the Cloudflare edge without your cookies, language or device, so sites that redirect by country, sign-in or device may send you somewhere else.

At most six responses are read per call; a longer chain is reported, and you can continue from the address shown.

Because one call may send six requests, about one link a minute can be expanded without signing in, and about ten when signed in.

The Expander shows where a link goes, not whether the destination is safe. The URL Safety Checker reads the final address for warning signs.

Every request reaches the shortener and the servers in the chain, which may count it as a visit and log the Mutqan server's address.

Security and privacy

The link you paste goes to the Mutqan server, which requests each hop itself; your browser never contacts the shortener or the destination. Nothing is stored — no link, no address, no result — and analytics count only the endpoint's name.

Each server in the chain receives the full URL of its hop from the Mutqan server. Short links often carry tracking codes or personal tokens, so avoid expanding links you were asked to keep private.

References

  • RFC 9110: HTTP SemanticsIETF · 2022The meaning of HTTP methods, header fields, status codes and content negotiation, independent of the wire version.
  • Redirections in HTTP — MDNMDN Web Docs (Mozilla)HTTP redirects: 3xx status codes with a Location header, permanent (301, 308) versus temporary (302, 303, 307), and how redirect loops arise.
  • Fetch StandardWHATWGDefines CORS: preflight requests, the Access-Control-* headers and which responses a browser may expose to a page.