Tool 1.4

Short URL unroller & link checker

See where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.

Online checkThe link goes to our server (api.ethorns.com), which follows each redirect for you and keeps only the result, in memory, for 10 minutes. It also looks up the final domain's registration date (kept for 1 hour).

An automated check; it doesn't guarantee security.

How to use it

Paste the short or suspicious link.
Press Unroll. Our server (api.ethorns.com) follows up to 10 redirects, so your device never visits the link.
Check the final destination and any warnings before deciding to open it.

Why short links deserve a second look

A short link like bit.ly/…, cutt.ly/… or acortar.link/… tells you nothing about where it goes. Scam texts use them because the real address would give the game away; shops and newsletters use them to count clicks. QR codes on flyers often hide one too. Unrolling shows the destination before you open anything.

It also untangles long links from emails and ads that bounce through tracking addresses before reaching the page, so you can see the real final domain.

A redirect chain, step by step

Paste https://bit.ly/3AbCdEf (an invented code). The table shows each step: 1, 301 on bit.ly; 2, 302 on a tracking address; 3, 200 on https://tubanco-verificacion.xyz/login. Above it, Final domain: tubanco-verificacion.xyz, registered 6 days ago, in red. A bank's name inside a domain that isn't the bank's, on a domain less than a week old: don't open it.

The numbers are HTTP status codes. 301 and 308 are permanent redirects, 302, 303 and 307 temporary ones; for you they all mean “go on to the next address”. “page redirect” marks a jump made with a refresh tag inside the page. 200 means the last page answered normally. A red 404 or 403 at the end means the page is gone or refused us, which can happen once a scam page has been taken down. The warnings flag a final page without HTTPS, look-alike (punycode) characters, a bare IP address and a chain of more than four redirects.

When a clean result still isn't safe

We follow HTTP redirects and refresh tags, not JavaScript, and we stop after 10 redirects or at a loop. Some scam links send servers to a harmless page and only send phones to the real one, so a clean result is not a guarantee. Results are kept for 10 minutes, so if a link's destination changed in that time, you may still see the older answer.

A common mistake is trusting a link because it ends on a big, well-known service. Anyone can publish a form, a free website or a shared file on those, and phishing pages live there too. If the final page asks for passwords, codes or card details, run the whole message through the scam checker.

FAQ

Is it safe to unroll a phishing link here?

Your device doesn't open it: our server does, reading only the response headers and the first 64 KB of each page, and running none of its code. The sender may see a visit from our server, and single-use links (password resets, confirmations, unsubscribes) can be used up by it.

Do you store the links I check?

They aren't written to disk or to any log. The result, which includes the link, is kept in memory for up to 10 minutes, so repeated checks don't hit the target site again, and then dropped.

Why does a link show fewer steps than in my browser?

Some sites redirect with JavaScript, which we deliberately do not run. We follow HTTP redirects and page refresh tags.

Will the sender know I checked their link?

The link service sees a visit from our server, not from you. It may count that as a click, but it doesn't get your IP address, your phone model or your location.

Can I check the link inside a QR code?

Yes. Read the code with our QR code reader, which shows its content as text without opening it. If it's a link, the reader brings you here with the link already filled in.

Guides for this tool

G1Is this link safe? How to check a link before you clickFind the real domain in a link, expand short links, spot look-alike letters and brand-new domains, and know what to do if you already clicked.
G6What is fbclid? How to remove tracking from linksfbclid, gclid and utm_ tags are added to links to see where each click came from. Learn what they reveal, which are safe to remove and how to clean a link.
G18Work-from-home task scams: paid to like videos on WhatsAppPaid to like videos or write reviews, then asked to deposit money to unlock tasks? How task scams work, the warning signs and what to do if you paid.
G19Package held text scam: how to check a delivery messageA text says your parcel is held and asks for a small fee or your address? How to check it with the courier, read the link, and what to do if you paid.
G21Fake DIAN emails: how to spot them and check what you oweA message says you owe DIAN, face an embargo or your RUT will be suspended? How to check it, see your real tax status, and what to do if you clicked.

1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌