How a Click short link is made and shown

No click tracking beyond a per-link counter. No visitor data is stored. The counter is one number per link — how many times its preview page has been served. It holds no time, no address and no browser. The privacy page lists every file the server writes.

The form on the home page sends one request to this site’s own endpoint, /api/shorten.php. The endpoint accepts a POST with a JSON body from this site’s own pages and nothing else: a request from another origin is refused before the address is read. Then, in order:

1. The address is checked against the rules in the terms. A refused address gets a sentence saying which rule refused it. Nothing is written.
2. The host is checked against the blocklist, a text file the people who run Click edit by hand.
3. The request is counted against the limit of 10 links an hour and 40 a day.
4. The link is written to the store under a new code.

An address that already has a short link gets the same one back, so one destination has one code and one counter.

A code is seven characters drawn from an alphabet of 28: 23456789bcdfghjkmnpqrstvwxyz. It has no 0, 1, i, l or o, so a code read from paper cannot be mistyped as a look-alike, and no a, e or u, so a code cannot spell a word. That gives 13,492,928,512 possible codes. Each character comes from PHP’s random_int, which the PHP manual describes as cryptographically secure and uniformly selected, and a new code is checked against every code in the store before it is used. Codes are lower case; a link typed in capitals still opens.

There is no database. The store is one text file that is only ever added to: one line per link, holding the code, the time and the destination. A write takes an exclusive lock on the file, so two links made in the same instant cannot take the same code or run their lines together. The file sits in a directory the web server is told to refuse, so it cannot be downloaded. It holds up to 50,000 links; past that the endpoint says the store is full.

Nothing in the store is rewritten. A link is withdrawn by adding its code, or its host, to the blocklist. From then on the link answers “410 Gone” with a page that says it is blocked, and its destination is no longer shown.

Opening a short link runs the same checks again on the stored address before anything is shown — a line in a file is not proof that it once passed. The page then prints the destination, the host, the date and the counter. Every character of the address is escaped before it is printed, so an address cannot add markup or script to the page.

The Continue button is an ordinary link marked nofollow noopener noreferrer. In the HTML Standard’s terms: Click does not endorse the destination, the destination gets no handle on the page you came from, and no Referer header is sent, so the destination is not told that you came from Click. The preview page is marked noindex, and it carries no analytics tag.

A host in non-Latin letters is shown in Unicode and in punycode, the ASCII form defined in RFC 3492 that a browser actually asks for. Two hosts that look the same in Unicode have different punycode.

It never opens a destination. There is no link checker, no title or thumbnail scraper and no DNS lookup in the code. That keeps the server from being used to reach machines it should not reach, and it sets the limit of what Click can tell you: which site a link leads to, not whether the site is safe.

Read on 28 September 2026 (UTC):

• WHATWG URL Standard, “ends in a number checker”: a host whose last label is a number is parsed as an IPv4 address. It is why Click refuses 2130706433 and 0x7f.1 as well as 127.0.0.1. The same standard lists credentials and a backslash in place of a slash as validation errors. Living Standard, last updated 10 September 2026.
• RFC 6761, Special-Use Domain Names, sections 6.2 to 6.5: test, localhost, invalid and the example domains.
• RFC 6762, Multicast DNS, section 3: names ending in .local are link-local, meaningful only on the network where they originate.
• RFC 3492, Punycode.
• HTML Standard, link types: nofollow, noopener and noreferrer. Living Standard, last updated 28 September 2026.
• PHP manual, random_int: “Get a cryptographically secure, uniformly selected integer”.

The other suffixes Click refuses are its own rule, not a quotation from a standard. The list of shortener hosts and how each was read is in the terms.

Click is published by Luxury American Brands LLC. Write to labs@labs.llc.