Is a URL shortener safe?
Is a URL shortener safe?
A URL shortener is as safe as the service that issued the link, because the link itself is nothing but a redirect. What separates providers is who may create one, whether the destination is checked, how fast a reported link dies, and whether anything is inserted between the scan and the page. A shortener failing those is a tool for whoever finds it first.
The reason the question keeps being asked is that a short link is deliberately unreadable. You cannot tell klipqr.com/7hK2mQx from any other seven characters, and that is the entire point when the link has to fit on a menu, a poster or a receipt. The same property is what makes it attractive to somebody hiding a destination on purpose.
So the honest answer is not about the format. It is about the operator, and the useful version of the question is what does this provider do before the link resolves.
The four questions that separate providers
These are the ones worth asking of any shortener, including this one. Each has an answer that can be checked rather than taken on trust.
1. Can anyone create a link without an account?
This is the one that decides most of the rest. An open shortener is found by spammers within days, and the damage is collective: one blocklisted destination can attach a browser warning to every link the domain has ever issued, including the ones printed on somebody else's menu. We require an email address and verify it before a link goes live. It is a security control wearing the label of a product feature.
2. Is the destination checked at all?
Screening a URL against a reputation service at creation time catches the known-bad case, which is most of it. It does not catch a destination that turns malicious afterwards, which is why the next question matters more than this one.
3. How fast can a bad link be killed?
Most answers to this are vaguer than they sound. A short link is served from a cache in every region, so deleting the row in a database does not stop it: the cached copy keeps redirecting until it expires. We keep a separate blocklist entry that is read alongside every lookup, in the same round trip, so a disabled link stops resolving while its cache entry is still warm. The floor on that cache is thirty seconds, so the honest figure is about thirty seconds worldwide, not "immediately".
4. What sits between the scan and the destination?
Some shorteners show an interstitial page, an advert, or a countdown before releasing you. Each is a place where something can be injected, and each trains people to click through a screen they have not read. Nothing of ours sits on that path on any plan. There are adverts on this site, on pages like this one; there are none on the redirect.
Is it safe to give someone a QR code?
Giving out a QR code is safe. A QR code is a way of writing text, and text cannot execute, so there is no virus to carry. The risk belongs to the person scanning an unfamiliar code, and the risk you carry as the publisher is different: somebody covering your printed code with a sticker of their own.
That sticker attack is the one worth designing against, and it is covered separately in QR code scams. The short version is that a code you can re-point is recoverable and a code encoding the destination directly is not: if a static code is compromised or its target moves, the only fix is reprinting everything already in the world.
What a shortener knows about the person who scanned
"Do URL shorteners track you" is really two questions: what is recorded, and what is kept. Counting scans is the product, so something is always recorded. What varies is whether the record can be traced back to a person.
We record the country and a coarse region, the kind of device, the operating system, the hour, and the referring host. We do not store the raw IP address at any point. It is hashed with a salt that rotates every day, which has a consequence we would rather state than hide: our repeat-scan figure measures same-day repeats and nothing longer, because yesterday's hashes cannot be matched to today's. Counting people across a month would need an identifier that survives the day, and that is exactly the identifier we chose not to keep.
For the same reason the free tools are metered by network rather than by browser. Following somebody across browsers means fingerprinting the device, and a private window, a second browser and a cleared cookie jar would each reset a per-browser limit anyway. An address survives all three and identifies nobody.
Kenya: what the Data Protection Act 2019 changes
Scan analytics are personal data under the Act once they can be tied to an identifiable person, and an IP address is the usual way that happens. The daily-rotating hash above is what keeps scan records from being that, and it is why the coarse region rather than a precise location is the finest geography we keep. It also means a deletion request has less to delete, which is the point rather than a convenience.
There is a second Kenyan angle that is less about the law and more about what people here actually receive. A message claiming a payment problem and carrying a link is the common pretext locally, and a shortener's own domain is an obvious thing to imitate: "your link was flagged, verify here" is the phishing email this brand would attract. Our sending domain is separate from the domain the codes resolve through, the apex publishes an SPF record that authorises no sender but our forwarder, and the DMARC policy is set to reject rather than quarantine. None of that protects a scan. It protects the inbox of somebody who has heard of us, which is a different job and worth doing separately.
On payments specifically, a QR code that starts an M-PESA payment is worth understanding on its own terms, and it is covered in the M-PESA guide.
How to check any provider, including us
None of the four questions needs inside knowledge. Try to create a link without signing in. Try a destination that is obviously bad and see whether anything objects. Create one, disable it, and time how long the old link keeps working. Scan one and watch whether a page appears before the destination does.
A provider that answers those four well is safe enough to print. One that cannot answer the first is not a shortener you should put on something you cannot take back.
Questions
The things people ask before they commit something to paper.
Is a URL shortener safe?
A short link is as safe as the service that issued it, because the link itself is only a redirect. What matters is whether anyone can mint one anonymously, whether the destination is checked against a reputation service, how quickly a reported link can be killed, and whether the redirect stays clean. A provider that fails the first two is a tool for whoever finds it first.
Which URL shortener is safest?
Judge any of them on four things rather than on brand. Does it require a verified account before a link goes live, does it screen destinations, does a takedown reach every region in seconds rather than hours, and does it put anything of its own between the scan and the destination. Ask those four of us too, and of whoever you use instead.
Is it safe to give someone a QR code?
Giving one out is safe. A QR code is a way of writing text and carries no code that can run. The risk sits with the person scanning an unknown code, not with you sharing a known one, and the risk you do carry is that somebody covers your printed code with a sticker of their own. That is why a code you can re-point beats a code you have to reprint.
Do URL shorteners track you?
Most record something, because counting scans is the product. The question is what they keep. We record country and a coarse region, the kind of device, and the hour, and we never store the raw IP address: it is hashed with a salt that rotates daily, which is why our repeat-visitor figure honestly measures same-day repeats and nothing longer. We do not fingerprint devices.
What happens to my links if I stop paying?
Here, they keep resolving. Free links never expire, never carry an interstitial and never show an advert, and a lapsed subscription does not break a printed code. That is a deliberate constraint rather than a promotion: a shortener whose links die is a shortener that turns every poster already in the world into a dead end.