How to Shorten a URL: Every Method, From Click to API

Shortening a URL takes one click, and for a link you'll share once that's all it needs. The interesting question is what you want the link to do afterwards — carry your name, be readable aloud, stop working after Friday, count its clicks — because each of those is a different way of shortening, and picking the right one up front saves reprinting, reposting and re-explaining. This guide covers every method from the quick one to the automated one, when each is the right choice, and what to do with the link once you have it.

Method 1: paste it — no account#

For a link you'll share once and don't need to manage.

1. Open the homepage.
2. Paste the long address into the box.
3. Press Enter or the arrow.

You get a link like xlyl.link/kZHTt5, copied and ready. It works immediately, redirects with a 302 so it's counted, and has a public statistics page. What it doesn't have is a name you chose, and it isn't attached to an account, so you can't edit it later.

Good for: a link in a chat, a one-off share, testing the service.

Method 2: name it — a custom alias#

For anything a person will read, say or type.

1. Sign in — accounts are free.
2. Paste the long address, then open Show advanced options.
3. In Custom alias, type the ending you want: spring-sale, menu, webinar.
4. Shorten.

The link is now xlyl.link/spring-sale. Aliases are unique per domain, so if someone has taken /spring-sale on the shared domain you'll be told; that's the moment to consider your own domain, where every alias is free.

The naming guide covers what makes a good alias: lowercase, hyphens, plain words, under about 30 characters, nothing that will be wrong next year.

Good for: anything on a slide, in print, spoken on a podcast, or in a post people will screenshot.

Method 3: your own domain#

For anything with your name on it — which, for a business, is everything.

1. On the domains page, read the two DNS records shown: an A record for a root domain, or a CNAME for a subdomain such as go.yourbrand.com.
2. Add the record at your DNS provider.
3. Add the domain on the page. Use Check DNS to confirm it's pointing here; it resolves the domain live and tells you what it found.
4. From now on, pick the domain in the shortener's advanced options when you create a link.

The link becomes go.yourbrand.com/spring-sale. HTTPS is issued automatically the first time the domain is visited. The custom domain guide walks through the DNS step with each common provider, and the custom URL shortener page explains why a branded link gets more taps than a bare one.

Good for: every link a customer, reader or follower will see.

Method 4: with a password or an expiry#

Both are in the same advanced options panel and combine with everything above.

Password. Type one in the Password field. Visitors get a form instead of a redirect, and the destination isn't sent to their browser until the password is right. This is real protection, unlike an obscure alias, whose destination is one preview away. Password-protected links suit drafts, previews, recordings and anything you'd rather not have forwarded.

Expiry. Set a lifetime — 30m, 8h, 7d — in the Expire in field. After it passes, the link returns a not-found page and its alias is freed. Expiring links suit time-boxed offers, event registration, and download links that shouldn't circulate forever.

Description. Not a protection, but set it now: what the link is for, who made it, the campaign. The dashboard searches descriptions, so this is how you'll find the link in six months.

Method 5: the API — many links, automatically#

For a spreadsheet of placements, a CMS that should shorten every article, a script that makes a link per customer, or anything else where a person clicking a form is the bottleneck.

1. On the API key page, generate a key. It's shown once; only a hash is stored.
2. Send a request with the key in the X-API-Key header:

curl -X POST https://xlyl.link/api/v2/links \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target":"https://example.com/spring","customurl":"spring-sale","description":"Spring 2026 · newsletter"}'

The whole address is stored as the destination, query string and all — the ? and & separators are part of the URI syntax defined in RFC 3986, and the redirect reproduces them exactly.

The response contains the short link. Every option the form has — alias, domain, password, expiry, description — is a field in the request, and the same key lists, edits and deletes links and reads their statistics. The API reference has every endpoint; the key page shows samples in curl and JavaScript that already contain your key.

Good for: bulk, automation, integration. There's no bulk upload form because a ten-line script handles any spreadsheet and any rule you want to apply to it.

Which method, when#

The methods stack. An API-made link can be on your domain, named, password-protected, expiring and described, all in one request.

After you've shortened it#

Copy it from the dashboard, not by retyping. Every link has a copy button; retyping is how l becomes 1.

Get the QR code if it's going on anything physical. The QR icon on the link downloads a code that encodes the short link, so the printed code stays valid however often you change the destination. The QR guide covers size and placement.

Watch the statistics page. Clicks by hour and day, referrers, countries, devices — with bots filtered out and no visitor IPs stored. For a campaign, make a separate link per placement so each count means something.

Edit it when things change. Target, alias, description and expiry can all be changed from the link's row. The short link stays the same; only where it goes moves. This is the single most useful thing about a shortener and the reason to use one even for links that don't need to be short.

Mistakes to avoid#

• Shortening a link with your own tracking parameters and then sharing the long one anyway. Share the short link only; the tags travel inside it.
• Choosing an alias with a date or version in it for something you'll reuse. You'll either reprint or live with a lie.
• Using a random code where a person will type it. x7Fq2 is a lost visitor waiting to happen.
• Relying on an obscure alias for privacy. Anyone can preview a link. Use a password.
• One link for every channel. You'll know the total and nothing else.
• Deleting a link that was printed. Point it somewhere useful instead; a dead short link is a dead end with your name on it.

Related guides#

• How URL shorteners work: redirects, lookups and analytics
• Custom short link best practices: naming and organising
• Are short links safe? How to check one before you click
• Free URL shortener · All features · API reference