About Xlyl

What it does#

You paste a long URL and get a short one back. That short link can live on your own domain, carry a password, expire on a schedule, and be pointed somewhere else later without the link itself changing. Every click is counted, with a breakdown by country, browser, operating system and referrer.

You do not need an account to shorten a link. You need one to keep a link, edit it, or see who clicked it. See the full feature list.

Why editable links matter#

The reason to use a shortener is rarely length. It is that a printed flyer, a slide deck or a published article cannot be edited once it is out in the world — but the link in it can be, if it points through a shortener you control. A campaign URL that changes, a product page that moves, a document that gets re-uploaded: none of those have to break the thing you already published.

How your data is handled#

Each click is recorded with its country, device, browser, referrer and campaign tags. The location is derived from the IP address without keeping the address, and repeat visits are counted through a hash whose salt is replaced every day, so unique counts work without anyone being identifiable. Bot traffic is filtered out so your numbers reflect real visitors.

Link passwords are hashed with bcrypt. API keys and the one-time tokens sent by email are stored hashed too, so a copy of the database does not hand over access to any account.

Built to be self-hosted#

Xlyl is open source and runs on Node.js, MySQL and Redis. You can run your own instance, point your own domain at it and keep every link and every click on infrastructure you control — which is the only way to be certain a shortener will not disappear and take your links with it.

There is a REST API for everything the interface can do, so it can sit behind your own tooling rather than being another dashboard someone has to remember to open.

Reporting abuse#

Short links get abused for spam and phishing. Targets are checked against banned domains and hosts, and anyone can report a link — reports go straight to the administrators and abusive links are removed.

Running your own copy#

The software is open source, which is meant literally rather than as a badge: you can read what it does, change it, and run it. That matters most as an exit. A hosted service you cannot leave is a dependency; one you could replace with your own server on a wet afternoon is a convenience.

Self-hosting suits organisations with a privacy or compliance reason to keep click data in-house, and anyone who would rather not depend on a service they do not control. It costs whatever a small server costs, and the operator of that instance becomes responsible for its uptime and its data — the privacy policy explains how that division works.

For everyone else, the hosted instance is the same software with somebody else doing the maintenance. Either way, links you put on a domain you own move with you.

What we will not do#

Short and worth stating plainly, because these are the decisions that get quietly reversed at other services:

• No advertising or interstitial between a click and its destination.
• No visitor identity. Clicks are recorded in full detail, but no IP address is written down and no identifier follows anyone between links or between days.
• No selling or sharing of link or click data with anyone.
• No feature withheld to create a paid tier. There is one tier and it is free.

If any of that ever changes, the change will be visible in the source before it is visible on the site.

What you actually get#

The product is one dashboard. A box to shorten a link, the figures that tell you whether anything is happening, and a table of everything you have made — each row one click from its statistics, its QR code, or an edit.

There is no onboarding sequence, no upgrade prompt and no feature that greys out. If you want the detail, the features page lists every option a link can carry and the exact limits that apply.