Are short links safe?

How attackers abuse shorteners

Attackers use short URLs to disguise phishing pages and malware destinations in messages that appear familiar or urgent. A recognizable shortener domain alone does not establish that the destination is trustworthy.

Cofense Intelligence (Jul 2024 to Jun 2025, via captaindns.com): malware rate on links from is.gd 49%, TinyURL 17%, t.ly about 15% (t.ly most observed by volume, about 85% of its malicious links were credential theft), Rebrand.ly 10%.

These figures describe observed traffic over that period and are not a judgment of any service's current controls.

How to check a short link

For a brandedshortlinks.com link, append + to see its public destination preview, for example brandedshortlinks.com/abc123+. Check that the destination host is the one you expect before following it. A preview is not a guarantee of safety.

If a message is unexpected, confirm it with the sender through a channel you already trust. Avoid entering passwords or downloading files from destinations you cannot verify. Use Report abuse on our preview or in the footer to flag a suspicious link.

Is Bitly safe?

Any shortener can be abused. We cannot assess another service's controls. Check any link with a preview before opening it. For our links, append + to inspect the destination. Our checks and reporting process are described below. No service can be assumed to catch everything.

What we do to limit abuse

Creating links requires an account and a verified email, on both the web and API.

Destinations must use http or https and be no longer than 2,048 characters. We reject embedded credentials, IP-literal hosts, localhost and private names, internationalized xn-- hosts, other shortener domains and links to our own domain.

We check a local blocklist on creation and every destination edit. Google Web Risk Lookup checks also run when configured. Without a Web Risk key, only the local blocklist applies. A Web Risk error or timeout allows the link and marks it for a later check.

Nightly rechecks cover links created in the last 30 days and links awaiting a recheck. A detected threat disables the link and records an administrative action.

Server rate limits apply to creation, signup, login, abuse reports and API requests. Rate-limit keys use hashed IP information; visitor IP addresses are never stored in click analytics.

Abuse reports enter an operations queue where an operator can disable a link or account. Report abuse is available in the footer, previews and disabled pages. Disabled links return a 410 page saying the link was disabled for abuse, instead of redirecting.

Phishing, malware, spam and illegal content are prohibited. We check every destination and disable links that break these rules.

If you believe a destination was blocked incorrectly, contact [email protected]. These controls reduce risk; they do not guarantee that every harmful destination is caught.

Frequently asked questions