End-to-end encrypted short links: how they work
The destination is encrypted; the key lives in the URL fragment, which browsers never send to the server.
By ShortFreeURL Team · 9 July 2026
The trick is the fragment
Everything after # in a URL is never transmitted to the server. Put the decryption key there and the server can store an encrypted destination it genuinely cannot read, while the browser has everything it needs.
What happens on a click
The server returns a small page containing the encrypted blob. JavaScript in the page reads the key from the fragment, decrypts the destination with the Web Crypto API, and navigates. The plaintext destination never touches the network.
What this protects against
A platform breach that exposes the link database. A subpoena for destination URLs. An insider reading customer links. It is a meaningful guarantee, not a marketing line — the server has no key.
What it does not protect
Anyone with the full URL can decrypt it. If the link leaks, the content leaks. It also does not hide the fact that a link exists, or click metadata like time and country.
The operational catch
Lose the fragment and the link is unrecoverable — by design. Copy the full URL including everything after # at creation time, because the key is shown once and never stored.
Side effects to expect
No link previews, because crawlers cannot decrypt. Slightly slower navigation, because a page loads before the redirect. Some link-scanning security tools will flag the pattern. Use it where the secrecy is worth those costs.