How to Vet Any Shortened Link Before You Click It (A Practical Checklist)
You can't see where a shortened URL goes just by looking at it — that's the entire point of shortening it. Here's a concrete, non-technical checklist for deciding whether to trust one anyway.
Start With the Context, Not the Link
Before evaluating the link itself, evaluate whether receiving it makes sense. Were you expecting this message, from this sender, about this topic? A shortened link claiming to be a shipping update you weren't expecting, from a sender you don't recognize, is suspicious regardless of what the link technically points to. Most phishing succeeds by manufacturing false urgency and false plausibility around the click — evaluate that first.
Check Whether the Sender Explains the Link
Legitimate senders generally tell you what a link is before asking you to click it: "Here's the invoice," "Here's the recording from our call." A shortened link sent with no explanation, especially combined with urgency ("click now," "verify immediately," "your account will be suspended") is a classic phishing pattern, independent of the link's actual destination.
Use a Link Preview Tool Before Clicking
Most major shorteners support a way to preview the destination without visiting it — commonly by appending a plus sign or a specific preview path to the short URL, which shows the destination and any safety information the provider has without actually loading the destination page. If you're unsure about a link and the service supports this, use it. If a shortener has no way at all to preview a destination before clicking, treat that as a point against trusting it for anything sensitive.
Check for a Descriptive Custom Alias
A link like pocolink.com/hr-open-enrollment tells you something verifiable about its claimed purpose. A meaningless string of random characters tells you nothing, and provides no way to sanity-check the sender's claim about what it is. This isn't proof of safety on its own — a malicious actor can choose any alias — but a descriptive alias combined with a plausible sender and context meaningfully increases confidence, while a random string with no context should decrease it.
Verify HTTPS on the Destination, Not Just the Short Link
A shortened link redirecting to an HTTPS destination is baseline table stakes today, not a strong trust signal on its own — most phishing sites use HTTPS too. But a redirect to a plain HTTP destination, especially one asking for login credentials or payment information, is a clear red flag regardless of anything else about the link.
When In Doubt, Don't Click — Ask
If a shortened link arrives in a context that feels even slightly off — an unexpected sender, unusual urgency, a request involving money or credentials — the lowest-risk action is to contact the purported sender through a separate, known channel and ask if they actually sent it. This single habit prevents the large majority of successful link-based phishing, regardless of how sophisticated the fake destination page turns out to be.