How URL Shorteners Work

Code generation and storage

The service generates a compact slug, validates that it does not collide with reserved routes and inserts it under a unique database constraint. Cryptographically secure random codes avoid exposing sequential record counts and make guessing less practical.

Collision handling still matters. Random generation reduces probability; it does not replace a unique constraint. A production service retries a bounded number of times when insertion reports a collision.

The redirect path

A request resolves the host and slug, checks status, expiration and any access rules, then returns the configured 3xx response. Frequently requested links can be cached, but edits and disabling require disciplined invalidation.

Analytics should be best-effort and asynchronous where the runtime permits. A reporting outage must not unnecessarily break a legitimate redirect.

Abuse and privacy

Only HTTP and HTTPS destinations should be accepted. Metadata fetchers must block loopback, private, link-local and cloud metadata addresses even after DNS resolution. Analytics can use rotating, one-way identifiers rather than storing raw IP addresses.