What it does
The link inspector reads a URL without opening it. It decodes redirect wrappers that carry the destination inside the link (Google, Facebook, Instagram, Outlook Safe Links, YouTube, LinkedIn, Reddit, Proofpoint and others), removes tracking parameters, shows the real registrable domain and warns about URL shorteners, raw IP addresses, punycode, @ tricks, brand names in the wrong domain and direct file downloads.
What does the inspector check?
It checks the URL text itself, offline: where the link really points, what's been added to it, and whether it uses known deception tricks.
| Check | Example | What it means |
|---|---|---|
| Redirect wrapper | google.com/url?q=https://... |
Decoded to the real destination |
| Shortener | bit.ly/3xyz, t.co/abc |
Destination hidden until followed |
| @ before the host | https://twitter.com@phish.example/ |
Browser goes to phish.example; the rest is decoration |
| Brand in the wrong domain | x-com-support.help |
Real site is x-com-support.help, not X |
| Raw IP address | http://192.168.4.20/claim |
Real brands use domain names |
| Punycode | xn--... |
May display with look-alike letters |
| Plain http | http://... |
Not encrypted |
| Direct download | .../invoice.zip, .apk |
Opens a file, not a page |
| Many subdomains | login.x.com.secure-check.example |
Read from the right: the site is secure-check.example |
How do I read a domain correctly?
Read the host name from the right: the last two parts (three for addresses like .co.uk) are the actual site, and everything to the left is chosen by whoever owns it.
x.com.account-review.help belongs to the owner of account-review.help. They can put any words they like in front, including "x.com". This is the single most useful habit for spotting phishing links in replies, and the inspector shows the real site on every result so you can build the habit.
How do I expand a short link safely?
Use the shortener's own preview page where one exists, or ask a terminal for the redirect without loading the page.
- bit.ly: add
+to the end of the link. - TinyURL: use
preview.tinyurl.com/followed by the alias. - t.co: on X, the link text in the post usually shows the destination. Hover or long-press it.
- Anything else: the inspector gives you a
curl -sILcommand that prints each redirect'slocationheader. It fetches the headers, not the page, so nothing renders and no scripts run. Your request still reaches the servers involved, so run it from a machine you don't mind them seeing.
Why strip tracking parameters?
They identify the campaign, the sharer or the click, add nothing to the page, and make links long and suspicious-looking.
When you approve a reply that contains a link, or repost a link yourself, the tracking tags travel with it. Cleaning them keeps links readable and avoids passing on someone else's attribution. Our guide to tracking parameters lists the common ones and which are safe to remove.
Common questions
Why can't it expand bit.ly or t.co links?
A shortened link only reveals its destination when you request it from the shortener's server. Browsers don't let one website read another site's redirects, and doing it through our server would mean visiting the link for you and logging it. So the inspector gives you safe ways to check instead, such as Bitly's info page or a terminal command.
How do I see where a bit.ly link goes without clicking it?
Add a plus sign to the end, like bit.ly/abc123+, and Bitly shows an information page with the destination instead of redirecting. TinyURL has a similar preview page at preview.tinyurl.com/alias. These are features of those services and could change, so the inspector shows them as suggestions.
Does "no warning signs" mean a link is safe?
No. It means nothing in the URL itself looks suspicious. A perfectly normal-looking domain can still host a scam page, and a new domain registered yesterday won't trip any URL checks. If a link asks you to log in or pay, go to the site directly instead.
Which tracking parameters does it remove?
utm_ campaign tags, click IDs from ad platforms (fbclid, gclid, msclkid, ttclid, twclid and others), email marketing IDs (mc_cid, _hsenc, mkt_tok), X's s and t share parameters and ref_src, YouTube and Spotify si parameters, and a few dozen similar ones. Parameters that change what the page shows are kept.