How URL Shorteners work

Key components

• API: Accepts a long URL, validates it, and returns a short code.
• Database: Maps short codes to long URLs and stores metadata like createdAt, expiration, and hit counts.
• Redirect endpoint: Resolves a short code and issues a 301/302 redirect.
• Analytics pipeline: Records visits for reporting.
• Cache: Optional layer (e.g., Redis/edge cache) to accelerate hot links and reduce DB pressure.

Short code generation

There are several approaches to produce a unique short code:

• Hashing: Hash the long URL (e.g., SHA-256), then Base62-encode the first N bytes. Fast but may require collision handling.
• Random IDs: Generate cryptographically secure random bytes and Base62-encode. Ensure uniqueness via database constraints.
• Sequential IDs: Use an auto-incrementing integer and encode in Base62. Very compact links, but be careful about predictability.

A common choice is to generate 6–8 character Base62 codes; this yields millions to trillions of combinations depending on length.

Storage and schema

A minimal relational schema includes a unique index on the short code and fields for targetUrl, createdAt,expiresAt (optional), and clicks.

Many systems add owner information, custom domains, and flags for safety reviews or rate limits.

Resolution and redirects

When a user visits a short link, the service looks up the code in the cache/database and issues an HTTP redirect:

• 302 (Found): Default, non-cacheable by browsers. Good when target may change.
• 301 (Moved Permanently): Cacheable; use when the target is immutable.

For performance, resolve from an edge cache when possible; fall back to the database if not found.

Analytics and logging

Minimal analytics include timestamps and totals. Rich analytics can include geo, user-agent, referrer, and unique visitors. Record events asynchronously so redirects remain fast.

Reliability and scaling

• Use unique indexes to prevent collisions.
• Add caching (Redis/edge) for hot paths.
• Replicate reads and separate write workloads.
• Rate-limit API to prevent abuse.
• Use background jobs for analytics and link checks.

Security considerations

• Validate and normalize URLs; allow only safe protocols.
• Block known malicious domains via deny-lists.
• Sign admin actions and protect with authentication and rate limits.
• Consider preview pages to reduce phishing/malware risk for unknown links.

Best practices

• Prefer Base62 for compact, URL-safe codes.
• Keep redirect handlers synchronous and fast.
• Expire or archive unused links when appropriate.
• Expose a simple API for programmatic shortening.