Is this short link safe? The short answer
Is this short link safe? You cannot tell by looking at it, because the whole point of a short link is to hide the destination. To check it, expand the link first with a tool like Lewati so you can read the real URL without opening it, check that the domain is the one you expected, then look the domain up on a reputation service such as Google Safe Browsing or VirusTotal. If any of those steps feels off, do not open it.
That takes about a minute. The rest of this page explains each step, the traps people miss, and what to do if you already clicked.
Why short links deserve a second look
A normal link shows you its domain before you click. A short link shows you the shortener’s domain, which tells you nothing about the destination. A bit.ly link to your bank and a bit.ly link to a phishing copy of your bank look identical.
Two more details make it worse. First, many shorteners let the owner change the destination later: Bitly offers link redirects on its paid plans, and Rebrandly’s paid plans include a monthly allowance of link destination edits. A link that was harmless when it was posted can point somewhere else today. Second, links can be chained, so one shortener sends you to another, and only the last hop is the real destination.
None of this means short links are bad. Most are fine. It means the shortener’s name is not evidence either way.
Step 1: expand the link without opening it
The goal is to learn the final URL while your browser stays away from it. Options:
- Lewati. Paste the link on the homepage and press Bypass. Lewati follows the redirects on its server, including ad-gated shorteners like exe.io and ouo.io, and shows the Real URL. If the result is another short link, paste that one too.
- The shortener’s own preview. Some services show a destination preview. On Bitly’s free plan, links now open on a preview page that shows the destination along with an ad. TinyURL has offered a preview feature for years. These are fine for their own links but do not help with other shorteners.
- Hover or long-press. On a computer, hovering shows the link address in the corner of the browser; on a phone, long-pressing shows it. That only reveals the short link itself, so it is a starting point, not a check.
If a link will not expand because it needs a captcha or login, treat it as unknown, not as safe.
Step 2: read the domain properly
This is where most people get caught, and it costs nothing. Find the registrable domain: the part just before the first single slash, read from the right. In https://accounts.google.com.secure-login.top/verify, the domain is secure-login.top, not Google. Everything to the left of it is a subdomain the attacker chose.
- Check spelling letter by letter: paypa1, rnicrosoft (“rn” posing as “m”), g00gle, extra hyphens or extra words.
- Be wary of unusual endings for a well-known brand. A bank does not usually live on a cheap new top-level domain.
- The padlock only means the connection is encrypted. Phishing sites get HTTPS certificates too.
- Ask whether the destination matches the promise. A “Google Drive file” should be on drive.google.com, a GitHub project on github.com.
Step 3: check the domain’s reputation
Run the domain past one or two independent services. Lewati’s result card links straight to most of them with the domain prefilled.
| Service | What it tells you | Watch out for |
|---|---|---|
| Google Safe Browsing site status | Whether Google currently flags the site as unsafe, the same data behind warnings in Chrome and Google Search | New phishing domains may not be listed yet |
| VirusTotal | Verdicts from many security vendors for a URL or domain | One or two flags out of many can be false positives; read which vendors flagged it |
| urlscan.io | A sandboxed visit with a screenshot, redirects and contacted domains | Public scans are visible to everyone; choose Private for links that might contain personal tokens |
| Sucuri SiteCheck | Known malware, blocklist status and visible injected code | Checks the public page, not files behind a login |
| Norton Safe Web, WOT, SiteAdvisor | Reputation ratings and user reports | Ratings lag behind brand-new domains |
A clean result is good news, not a guarantee. Scam domains are often only days old, and blocklists need time to catch up. That is why Step 2 matters as much as Step 3.
Step 4: check the context
The link’s surroundings tell you as much as the URL. Slow down if:
- the message is urgent: your account will be closed, a package is held, a prize expires today;
- it comes from a contact who does not normally send links like this, which can mean their account was taken over;
- the destination asks you to log in, pay, or enter a one-time code right away;
- it starts a download you did not ask for, especially .exe, .apk, .scr or a password-protected zip;
- it offers something too good to be true: free premium accounts, game currency, cracked software.
When a link claims to be from a service you use, skip the link entirely. Type the service’s address yourself or open its app, and look for the same notice there.
Does a VPN or antivirus make this unnecessary?
No, though both help at the edges. A VPN encrypts the connection between you and the VPN server and hides your IP address from the sites you visit. It does not change where a link goes, and a phishing page is just as convincing over a VPN. Surfshark, which sells a VPN, says plainly on its own blog that a VPN cannot prevent phishing attacks.
Some VPN and antivirus products add blocklists that stop known-bad domains, such as NordVPN’s scam and phishing protection or Proton VPN’s NetShield. They catch what is already on the list. Reading the real URL catches the rest, like a “Google Drive” link that actually goes to a random file host. If you are choosing a VPN anyway, our NordVPN alternatives comparison covers what each one includes.
If you already clicked
Clicking alone rarely does lasting harm on an up-to-date browser. What you do next matters more.
- Close the tab. Do not enter anything and do not accept downloads or notification prompts.
- If you typed a password, change it now on the real site, starting with your email account, and turn on two-factor authentication.
- If you entered card or bank details, call your bank using the number on your card.
- If a file downloaded, delete it without opening it and run a scan with your security software.
- If the link came from a friend’s account, tell them through another channel. Their account may be compromised.
Frequently asked questions
Can a short link itself contain a virus?
No. A short link is only an address that redirects somewhere else. The risk is the destination: a phishing page, a malicious download, or an ad page with fake buttons. That is why expanding the link and reading the destination is the most useful single step.
Is a VirusTotal check enough to call a link safe?
It is a strong signal but not proof. Brand-new phishing domains can show zero detections for a while. Combine it with reading the domain yourself and checking that it matches what the message promised.
How do I check a link on my phone?
Long-press the link and choose Copy, then paste it into Lewati in your mobile browser. Lewati shows the real URL and the safety lookup buttons work on mobile too.
What if Lewati cannot expand the link?
Lewati shows a reason, such as a captcha, a login requirement, bot protection or an expired link. Treat an unexpandable link from an unknown sender as unknown. If you must open it, do so in an up-to-date browser and do not log in or download anything from it.