How do I see where a shortened link actually goes before I click it?

This page may contain affiliate links from which Blur Studio earns commissions.

Link shorteners exist for a real reason: a long, ugly tracking URL becomes a clean, short one that's easier to share, especially on anything with a character limit or where a tidy link just looks better. The side effect is that the short link tells you nothing about where it actually goes until you've already clicked it, by which point it's too late to change your mind if it was something you shouldn't have opened.

Why this is worth taking seriously, not just mildly annoying

Shortened links are a genuinely common tool in phishing and scam emails precisely because they hide the real destination. A link that visibly reads as a suspicious domain gets noticed and ignored; the same scam wrapped in a clean-looking short link doesn't give you that visual warning at all. For anyone handling business email, especially anything that looks like it's from a bank, a supplier, or a client asking you to click through to "review an invoice," checking the real destination before clicking is a small habit with real downside protection.

What Switchbar actually does here

Confirmed directly on WebCatalog's own Switchbar page: it includes a URL unshortener that expands a shortened link to reveal its real destination, and a tracking cleaner that strips tracking parameters from the URL, both happening automatically as part of the same click-routing process Switchbar already does for choosing browsers and profiles, as in keeping work links out of your personal Chrome profile. You don't run a separate check; it's built into the normal flow of clicking any link once Switchbar is set as your default handler.

It's confirmed free, with no stated limit on how many links you can check this way.

Step by step: how to use this

1. Install Switchbar from WebCatalog's Switchbar page and set it as your default link handler.
2. Click a shortened link as you normally would, from email, a text message, or anywhere else. Switchbar intercepts it before it opens anywhere.
3. Look at the expanded URL Switchbar shows you before confirming where it should open. This is the actual moment of protection: a genuine destination reads as expected, an unexpected or mismatched domain is your signal to stop.
4. If anything looks wrong, don't proceed. Close it, and if it arrived in a work context, report it the way your business normally handles suspicious email, rather than just quietly ignoring it.
5. If it looks right, continue as normal; the tracking parameters get stripped automatically as part of the same step, so the link you land on is also cleaner than the one you started with.

A realistic example: an invoice-themed phishing attempt

Imagine an email arrives that looks like it's from a supplier, asking you to click a shortened link to "review the attached invoice." Without checking the real destination, you'd be clicking blind, trusting the sender's name and the plausible-sounding message alone. With Switchbar intercepting the click, the real destination shows up before anything opens, and if it points somewhere that has nothing to do with your actual supplier, a generic login page, an unfamiliar domain, you've caught it before entering any credentials or downloading anything, rather than after.

What this does not protect against

This is the part worth being completely honest about, since it's easy to overstate what a tool like this does. Switchbar's own page is explicit: it does not detect phishing. Expanding a shortened link shows you the real destination, but it doesn't evaluate whether that destination is itself malicious, a convincing fake login page can sit behind a perfectly real-looking expanded domain, and a typo-squatted domain (one letter off from the real company's) can look legitimate at a glance even once expanded. This tool removes the blindfold of a shortened link; it doesn't replace actually training yourself or your staff to recognize what a scam looks like once you can see it clearly.

A realistic team scenario worth planning for: a staff member sees an expanded URL that looks slightly off but isn't sure whether it's actually malicious or just an unfamiliar legitimate domain. The right default isn't "decide alone and hope," it's a quick second opinion, forwarding to whoever handles IT or security questions, or simply not clicking until someone more confident looks at it. Seeing the real destination only helps if the person looking at it also knows what a suspicious domain pattern actually looks like, which is a training problem Switchbar doesn't solve on its own.

Should you rely on this alone?

No, and it's not meant to be the only line of defense. Pair it with the basics that actually catch most phishing attempts: checking the sender's actual email address, not just the display name, being suspicious of urgency ("review this invoice today or your account is suspended"), and never entering a password on a page you reached by clicking a link in an unsolicited message, expanded or not. Switchbar removes one specific piece of the trick, the hidden destination, and leaves the rest of the judgment to you.

When to skip this

If you rarely encounter shortened links, or you already paste suspicious ones into a separate link-checking site before clicking, this specific feature of Switchbar is solving a problem you've already handled another way. It earns its place for anyone who clicks links from email or messaging apps regularly enough that pasting each one into a separate checker isn't realistic.

A worked example: a team targeted by invoice fraud attempts

Small businesses that handle supplier payments are a common target for invoice fraud, an email that looks like it's from a known supplier with a shortened link to a "revised invoice." A staff member trained to automatically see the expanded real destination before clicking, because that's just what happens by default on their machine, catches an obviously wrong domain in a few seconds, something they might have missed entirely if the only way to check was remembering to manually look up a shortened link on a separate website first. The protection here comes specifically from making the safe behavior the automatic default, not from training people to remember an extra security step they'll skip when busy. Pair this with a simple second rule for anything involving money specifically: confirm a changed payment detail by phone, using a known number, not by replying to the email itself, regardless of how legitimate the expanded link turns out to look. If you handle several client logins, switching between client accounts without logging out is the related habit.

How I'd approach this

For an individual, Switchbar is a free, sensible habit to add, and I'd combine it with basic staff training rather than treating it as a complete security solution on its own. Where I get involved is a business that wants actual email security controls, link-scanning at the email gateway, staff phishing-simulation training, or incident response processes, which is a different, more serious layer of protection than a personal browser-level tool was ever meant to provide.