The Twitter/X Redirection Architecture: What is t.co?
t.co is the proprietary domain shortening service operated by X (formerly Twitter). Whenever an account shares a link in a tweet, direct message, or profile bio, Twitter automatically rewrites the URL into a shortened https://t.co/xxxxxxxxxx address.
Even if a tweet visibly displays a full domain like nytimes.com/article, clicking that link actually routes your browser through Twitter's t.co redirect servers first before forwarding you to the article.
Why Does Twitter Wrap Every Link & Why Should You Expand It?
Twitter wraps outbound URLs for two operational reasons: to track engagement analytics across the platform and to screen links against known malware databases. However, this creates several challenges for users:
Eliminate Redirection Latency
The t.co wrapper introduces an extra server round trip every time you click a tweet link. Expanding the link allows you to navigate directly to the destination.
Inspect Suspicious Viral Tweets
Compromised verified accounts frequently promote cryptocurrency scams or phishing portals using deceptive tweet text that masks malicious t.co destinations.
Bypass Social Tracking Telemetry
Visiting a link via t.co allows Twitter to log your click against your user profile and ad preferences. Expanding the URL preserves your reading privacy.
Copy Clean URLs for Sharing
Extract the canonical news article or blog post URL without sharing clunky Twitter wrapper links in your work Slack or email.
How to Unshorten t.co Links Step-by-Step
Copy the Link Address from X (Twitter)
Right-click the link in your web browser (or tap and hold on mobile) and select Copy Link Address.
Paste into the t.co Expander
Paste the https://t.co/... link into CheckURLRedirect and hit Check URL.
Extract the Canonical Destination
View the real destination URL, verify intermediate hops, and click Copy Clean Link to share with colleagues.
Security Analysis: Uncovering What Lies Behind Viral Tweets
When high-profile social media accounts are compromised, attackers post urgent tweets (e.g. “Breaking: Special airdrop for community members!”). Expanding the link immediately reveals whether the destination points to an official domain or an unauthorized phishing site.