URL Shortener

mdi-flower

About Me

Skills

Projects

Blog

Tools

Contact Me

Request Service

العربية

Home

Tools

URL Shortener

Turn long links into short, shareable wfiori.co links.

Shorten

Your short link

How this URL shortener works

Shorten a link above and watch exactly what happens behind the scenes — from validation and bot protection all the way to storage and the permanent redirect. Every value below comes from your actual request.

The pipeline

mdi-link-variant

Input

→

mdi-shield-check

Validate

→

mdi-cog

Proof of work

→

mdi-dice-5

Generate code

→

mdi-pound

Hash

→

mdi-database

Store

→

mdi-cursor-default-click

Lookup

→

mdi-arrow-right-bold

301 redirect

Shorten a link above to see each stage light up with real data.

Replay animation

mdi-link-variant

You submit a URL

The long URL is sent to the server over the shorten-link API together with the solved proof-of-work challenge.

Your URL {{ steps.input }}

mdi-shield-check

The server validates it

Only http/https are accepted. Links to internal or private hosts are rejected so the shortener cannot be abused to reach internal systems.

Scheme {{ steps.input ? steps.input.split('://')[0] : '' }}

Validation {{ step_validation_status }}

mdi-cog

Proof of work is verified

Your browser already solved a puzzle: find a number whose SHA-256 hash starts with several zeros. The server verifies the signed challenge and the solution before doing any work.

Challenge nonce {{ pow_debug.nonce }}

Difficulty (leading zeros) {{ pow_debug.difficulty }}

Solution found {{ pow_debug.solution }}

Resulting hash {{ pow_debug.hashPreview }}

mdi-dice-5

A short code is generated

A 6-character code is drawn from a 62-character alphabet using a cryptographically secure random generator, giving an enormous, unguessable keyspace.

Alphabet size {{ steps.alphabetSize }}

Code length {{ steps.codeLength }}

Keyspace {{ keyspace_text }}

Generated code {{ steps.code }}

mdi-pound

The URL is normalized and hashed

The scheme and host are lower-cased, then the result is hashed with SHA-256. This hash is stored in a UNIQUE column so the same destination always maps to one code.

Normalized URL {{ steps.normalized }}

SHA-256 hash {{ steps.hash }}

mdi-database

The record is stored

The code, destination, hash, creation time, and creator IP (for abuse tracing only) are inserted into the short_url table. If the hash already exists, the existing code is returned instead.

Result {{ dedup_text }}

mdi-cursor-default-click

Someone opens the short link

When https://wfiori.co/<code> is visited, the resolver looks the code up by its primary key — an O(1) index lookup.

Lookup key (id) {{ steps.code }}

Short URL {{ steps.shortUrl }}

mdi-arrow-right-bold

They are redirected

The server responds with an HTTP 301 permanent redirect to the original URL, and the click counter is incremented.

Response {{ redirect_text }}

mdi-table

Where it is stored: the short_url table

Every short link is a single row in this MySQL table. The short code is the primary key, and url_hash carries a UNIQUE index that powers both de-duplication and fast lookups.

Column	Type	Purpose
`id`	`VARCHAR(6) PK`	The short code itself and the primary key. Lookups by code are O(1).
`created_at`	`TIMESTAMP`	When the link was created.
`redirect_to`	`VARCHAR(2048)`	The original (long) destination URL.
`url_hash`	`VARCHAR(64) UNIQUE`	SHA-256 of the normalized URL. UNIQUE — enforces de-duplication at the database level.
`number_of_clicks`	`INT`	How many times the short link has been visited.
`ip_address`	`VARCHAR(45) NULL`	Creator IP, stored for abuse detection only. Never exposed to users.

mdi-shield-lock

The protection layers

Because a public shortener is a magnet for spam and phishing, several self-hosted defenses run on every request — no external services, no CAPTCHA.

mdi-cog-sync

Proof of work

A signed, expiring computational puzzle the browser must solve, making mass automated creation expensive.

mdi-speedometer

Rate limiting

Per-IP (per-minute and per-day) limits plus a global circuit breaker, all derived from the database.

mdi-shield-check

Destination validation

Scheme allowlist and blocking of internal/private hosts to prevent SSRF and redirect loops.

mdi-robot-off

Honeypot field

A hidden field real users never fill; if it is populated, the request is silently rejected as a bot.

mdi-ip-network

IP logging

The creator IP is recorded for abuse tracing — stored server-side only and never returned by the API.

mdi-key-variant

Unguessable codes

CSPRNG-generated codes over a 62-character alphabet make enumeration impractical.

The concepts

A URL shortener stores your long link in a database under a short, unique code. When someone visits the short link (https://wfiori.co/<code>), the server looks up the code and redirects them to the original URL.

The short code is a 6-character string generated using a cryptographically secure random generator. With 62 possible characters per position, there are about 56.8 billion combinations, which makes codes practically impossible to guess or enumerate.

If you shorten the same URL twice, you get the same short code back. The link is normalized (scheme and host lower-cased) and hashed with SHA-256; a unique index on that hash de-duplicates links at the database level.

Public URL shorteners are a common target for spam and phishing. This tool is protected by several self-hosted layers — with no external services such as reCAPTCHA, and no tracking of visitors.

Instead of a CAPTCHA, your browser must solve a small proof-of-work puzzle before a link is created: it searches for a number whose SHA-256 hash starts with several zeros. This takes your browser a fraction of a second but makes mass automated abuse computationally expensive. The challenge is signed by the server (HMAC) and expires, so it cannot be forged or reused.

When you create a link, your IP address is stored alongside it. This is used only to detect and trace abuse (spam, phishing) and to enforce rate limits. It is never shown to other users or returned by the API. Note: IP addresses are retained indefinitely for abuse-prevention purposes.

Every destination is validated on the server: only http and https links are allowed, and links pointing at internal or private addresses (localhost, private IP ranges, link-local) are rejected to prevent the shortener from being used to reach internal systems. Rate limits also cap how many links a single IP — and the service as a whole — can create per minute and per day.