How to Shorten URLs Safely
Shortened URLs save space and look cleaner, but they also hide the destination — which makes them a favourite tool for phishing attacks. This guide covers how to shorten links safely using services like goto.now and bit.ly, plus the security practices that protect both you and your audience.
Why Shorten URLs?
Long URLs with tracking parameters, session tokens, and nested paths are ugly in emails, social posts, and print materials. A shortened link like goto.now/xyz is easier to share, easier to remember, and takes up fewer characters in platforms with length limits. Marketers use shorteners to track click-through rates, while developers use them to share temporary staging links.
The key is choosing a shortener that prioritises transparency and does not inject ads or redirect through suspicious domains.
goto.now — Clean and Simple
goto.now provides short, memorable links with no sign-up required. It does not inject interstitial ads or track users beyond basic click counting. The generated links are short (typically 6-8 characters) and use HTTPS by default. For quick, no-fuss link sharing it is one of the cleanest options available.
bit.ly — The Industry Standard
Bit.ly has been the default URL shortener for over a decade. The free tier gives you basic analytics (clicks, referrers, geographic data), custom back-halves (e.g., bit.ly/my-custom-slug), and QR code generation. The paid tiers add branded domains, deeper analytics, and team collaboration.
The downside is that bit.ly links are so common that some email filters flag them. For professional use, a branded short domain is worth the investment.
+ to the URL (e.g., bit.ly/abc123+) to see where it leads without actually visiting the page. This simple habit blocks most phishing attempts.Security Best Practices
Never shorten a link that already contains sensitive information like API keys, tokens, or session IDs. The short URL itself becomes a permanent reference to that sensitive data, and anyone who guesses or brute-forces the short code gains access.
Always use HTTPS shorteners. If the shortener serves the redirect over plain HTTP, a man-in-the-middle attacker can intercept and modify the destination. Both goto.now and bit.ly default to HTTPS.
For internal team links, consider self-hosted shorteners like YOURLS or Shlink. They give you full control over the redirect database and eliminate third-party tracking entirely.
Encoding URLs Before Shortening
If your original URL contains special characters, spaces, or non-ASCII text, encode it first using the URL Encoder on tools.fun. This prevents the shortener from misinterpreting query parameters or breaking the link. A clean, properly encoded URL also reduces the chance of 404 errors when someone clicks the shortened version.
When Not to Shorten
Avoid shortening URLs in legal documents, contracts, or regulatory filings — the destination must be verifiable. Similarly, do not shorten links in source code or configuration files; use the full URL so that the codebase remains self-documenting. And never shorten links in security advisories or CVE references, where trust in the destination is critical.
← Back