Inspecting a suspicious link before clicking it
Decoding reveals the real destination hidden inside a redirector's parameters, without requesting anything from the attacker's infrastructure.
URL & Links🌐 YAS server-sideAPI availableintermediate
URL Expander
Fetches a URL and resolves the final destination after redirects.
Processed by YAS · not stored
Ready to runInstant execution
Loading tool…
What does this tool do?
Fetches a URL and resolves the final destination after redirects.
Why would I use it?
- A short link is hiding its destination and you want to see it.
- You want to know where a redirect chain ends up before clicking.
- You are auditing links in emails or ads.
Real-life example
Input
https://short.example/abc
Output
Final: https://real-site.example/product?ref=xyz (3 redirects)
YAS follows redirects safely and reports each hop.
Input → Process → Output → Next
- Input
- Paste a URL.
- Process
- YAS fetches the URL, following redirects with SSRF-safe checks.
- Output
- The final URL and the redirect chain.
- Next action
- Decide whether the destination is trustworthy before clicking.
Common mistakes
- Using it on private/internal URLs (blocked for security).
- Expecting it to execute JavaScript redirects.
- Ignoring the hop count when the destination changed.
What the result means
The final URL is where the chain actually lands.
Privacy & security
Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.
API
Endpoint
POST https://yas.sh/api/v1/tools/url-expander
Request Header
Content-Type: application/json
cURL
curl -X POST "https://yas.sh/api/v1/tools/url-expander" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com/a?x=1#top"}'JavaScript
const res = await fetch("https://yas.sh/api/v1/tools/url-expander", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
"url": "https://example.com/a?x=1#top"
}),
});
const data = await res.json();Python
import requests
r = requests.post("https://yas.sh/api/v1/tools/url-expander", json={"url":"https://example.com/a?x=1#top"})
data = r.json()| Field | Type | Required | Description |
|---|---|---|---|
| url | string | Yes | http/https URL |
Success response
{ "protocol": "https:", "host": "example.com", "pathname": "/a", "queryParams": [{ "key":"x","value":"1" }], "hash": "#top" }Decode and dissect a URL into parts and query parameters.
Error responses
400 VALIDATION_ERROR— invalid input or unsupported option.413 PAYLOAD_TOO_LARGE— input exceeds the 64 KB limit.429 RATE_LIMIT_EXCEEDED— rate limit exceeded (60 req/min).
Limits
- Maximum input: 64 KB per request.
- Rate limit: 60 requests/min per IP address.
- Authenticated accounts benefit from higher tier quotas.
URL Expander: technical reference, use cases and FAQ
How URL Expander works
Expansion decodes percent-encoded sequences, separates the query string into individual key/value pairs, and presents each component in a readable form — including nested URLs that were themselves encoded to travel inside a parameter. Redirect and tracking links routinely carry two or three layers of encoding, and reading them requires unwinding each in order.
Where a short link is involved, the destination is only visible by following the redirect chain, which is a network operation with its own risks: the target may log the request, may serve different content based on the client, and may itself be a further redirector. Decoding is safe and local; following is not, which is why the two operations are distinct.
When to use it: real-world scenarios
Auditing a tracking link
Ad networks and email platforms wrap destinations in multiple layers. Unwrapping shows which identifiers travel with the click.
Debugging an OAuth or SSO flow
Authorization URLs carry an encoded redirect_uri, state and scope. Reading them decoded is far faster than mentally decoding a 400-character string.
Understanding a deep link
Mobile deep links embed encoded paths and parameters that determine which screen opens; expansion shows the actual routing target.
Pro tips
- %2520 means the value was encoded twice — %25 is the encoding of the percent sign itself. Fix the layer applying the extra pass rather than decoding twice on receipt.
- Decode before judging a link. A destination that looks safe in encoded form can hide a different host in a parameter.
- Watch for the userinfo trick: an @ symbol inside what appears to be a path changes which host the browser actually contacts.
- Never open a suspicious expanded URL directly. Decoding is local; visiting is not.
Limitations and edge cases
What this tool deliberately does not do, and where it will disagree with other implementations.
- Decoding does not resolve short links — that requires following the redirect, which is a separate network operation.
- Whether '+' meant a space or a literal plus depends on the producer's convention and cannot be inferred.
- Base64 or custom-encoded payloads inside parameters are shown as-is; use the Base64 tools for a second decoding pass.
- Fragments are decoded but are never transmitted to the server, so they may not reflect server-side behaviour.
Frequently asked questions
- Does this follow short links to the destination?
- Decoding is local and requests nothing. To follow a chain of redirects and see each hop, use the Redirect Tracer, which makes actual requests.
- Why does the decoded URL contain another full URL?
- Because it is a redirector or tracker: the real destination travels percent-encoded inside a parameter such as url=, u= or redirect_uri=.
- Is it safe to expand a suspicious link here?
- Yes — the string is decoded in place with no request made, so the target's infrastructure never learns you looked at it.
- What does %2520 mean?
- Double encoding. A space became %20, then the percent was itself encoded to %25, giving %2520. It signals two layers applying encoding independently.
Related tools