What a short link actually is
A short link is not a copy of your address — it is a pointer to it. This tool stores your destination against a 8-character code and hands you an address ending in that code; whoever follows it is sent on with an HTTP 302, so their browser asks this service where to go every single time.
/s/aB3xK9 → 302 → your destination — asked again on every visit, which is what makes the destination changeable
A permanent redirect would be cached by every browser that followed it once, and re-pointing the link later would reach only people who had never used it. Every hop here is temporary, uncached, and marked so search engines neither index the link nor pass this site's ranking on to yours. Destinations may be up to 2,000 characters and must be http or https — a short link that could carry any scheme would be a way to host an attack behind a name people trust.
Every option on the form
One field is required and the rest are switches. Each one is off until you turn it on, and a panel that is off sends nothing.
| Option | What it does | Reach for it when |
|---|---|---|
| Destination | Where visitors end up. Required, and re-checked every time the link is followed. | Always. A bare host gets https:// added. |
| Custom name | You choose the end of the link instead of having one drawn. | The link goes on a poster, a slide, or anywhere someone reads it aloud. |
| Password | Visitors land on a gate and type a password before the redirect happens. | The destination is not secret, but you would rather it were not stumbled upon. |
| Starts | The link answers with a “not live yet” page until this instant. | The link is printed before the thing it points at exists. |
| Expires | The link stops working at this instant and says so. | An offer, an event, or anything with a last day. |
A custom name is 3 to 40 characters of lowercase letters, numbers and single hyphens, and cannot start or end with one. Capitals and spaces are folded for you — “Summer Sale” becomes “summer-sale”. Names that could be mistaken for something this site owns, or that a phishing link would want, are refused. If somebody already has the name you asked for, you are told so rather than quietly given a different one.
A link password is at least 4 characters and is stored as a salted PBKDF2 digest, never as text. It cannot be recovered — only replaced or removed from the edit page. Treat it as a curtain rather than a lock: it keeps a link from being casually opened, and nothing more.
Both ends of the window are read in the time zone of the browser you fill the form in, and stored as an exact instant — so a link set to expire at 5pm in Dhaka expires at that moment everywhere. The start is inclusive and the expiry is exclusive. An expiry that has already passed is refused rather than saved, so “saved” never quietly means “still broken”.
Changing where a link goes
Every link is created with a second address: its edit link. Open it and you can change the destination, add or remove the password, and move either end of the window. The short link itself is never editable, because everything already shared would break.
The edit link carries a 40-character token, which is the only credential involved. It is stored as a SHA-256 digest, so a copy of the database does not hand anybody the ability to re-point your links. It is also shown exactly once, and cannot be recovered afterwards.
There are no accounts, so the token is the whole of the security model. Anyone holding it can re-point your link; nobody without it can.
- Changing the destination takes effect immediately, everywhere the link has been shared or printed.
- Removing a password takes effect on the next visit — anyone already through the gate has already been sent on.
- A link cannot point at another short link on this site, on the way in or on the way out. A chain of redirects is how a destination gets hidden.
The list this browser keeps
Every link you create is saved to this browser's local storage, up to 20 of them, newest first. Nothing about that list leaves your machine — it is not an account, and this service cannot see it.
Each entry keeps the edit link along with the short one. That is deliberate: an edit link shown once and never saved is a feature nobody can use. It also means the list is a credential store, so it comes with a button that empties it, and it is worth using that button on a shared machine.
Clearing your browser's site data clears the list too, and the links themselves keep working — the list is a convenience, not the record. If a link matters, save its edit address somewhere you trust.
What this service refuses to do
A public link shortener is an abuse surface before it is a feature. Anything that lets a stranger create a redirect on a domain other people trust is, without care, a phishing host that happens to shorten URLs.
So creation sits behind a challenge, destinations are limited to http and https, and a short link may never point at another short link on this host. Every hop is sent with no referrer, is never cached, and carries a header telling search engines not to index it or pass any ranking to the destination.
None of that makes a short link trustworthy on its own — no shortener's does. If you are following one you did not create, the only thing it tells you is that somebody wanted you to click it.
- Names like “login”, “verify” and “secure” are reserved, because a link reading like one is a lure wearing this site's name.
- The destination behind a password gate is never sent to the browser until the password checks out.
- A link's visit count is the only thing recorded. There is no per-visitor log, no fingerprint, and nothing handed to the destination.