Tool / Links

URL Shortener

Kitly URL Shortener stores a public destination on Kitly and returns a short redirect. This is the only current tool that needs Kitly servers for the result.
Guidance published by Kitly

How to create a short link

Use a short link for convenience, but keep the destination clear and test the redirect before sharing it widely.

  1. Check the destination

    Open the final public HTTP or HTTPS URL first and confirm that it is correct, safe, and usable on mobile.

  2. Choose an optional slug

    Leave the slug blank for an automatic code, or enter a short lowercase name using letters, numbers, and hyphens.

  3. Create and test

    Generate the link, open it in a new tab, and verify the redirect before adding it to a document, profile, QR code, or campaign.

Safer short-link sharing

  • Tell recipients where the link leads when the surrounding message does not make the destination obvious.
  • Keep a record of the original destination because a compact link is harder to audit by sight.
  • Use custom slugs that remain understandable over time and do not expose private names or campaign secrets.

Service and privacy notes

  • Short links depend on Kitly servers and storage; they cannot redirect during a service outage.
  • The destination URL, short code, timestamps, and limited security metadata are processed to operate and protect the service.
  • Links cannot currently be edited or deleted through a self-service dashboard, so verify the destination before creation.

Practical guidance

These states show what the shortener actually returns for a custom slug, a collision, a blocked destination, a rate limit, and a disabled link. The sample file records a local database check. It is not a production link, and this page cannot edit or expire a link after you create it.

The form needs JavaScript to send the destination to Kitly and show the result. The rules and recorded states below stay readable without JavaScript. Creating a link still requires the server.

Recorded link states

No short link was created for this page, in production or again in local storage. The 201 and 302 pair is the local D1 check from 11 October 2026.

Custom slug that redirected locally

A public HTTPS destination and the slug av02-valid were stored on local D1. Creating it returned 201, and opening the code returned 302 to that same destination.

Long URL

https://example.com/path?x=1
Settings
Custom slug av02-valid

Observed result

POST returned 201 with code av02-valid, shortUrl <request-origin>/s/av02-valid, and targetUrl https://example.com/path?x=1. GET /s/av02-valid returned 302 to https://example.com/path?x=1.

What to check

The short code is a redirect, not a copy of the destination page. The stored target kept the path and query because the URL parser did not need to add anything. A host-only value such as https://example.com is stored as https://example.com/. Tell people where the link goes; the code itself does not show the destination.

Caveats

  • This code was observed on local D1. Do not expect https://kitlyapp.com/s/av02-valid to exist.
  • There is no self-service edit, expiry, or delete. The redirect stays until the row is disabled in storage.

Example files

  • local-response-states.json Inspection aid with the local 201/302 observation and the JSON bodies this route returns. Not a live short link.

Collisions and slugs the server will not assign

A custom slug is optional. When you set one, it has to match the pattern, avoid the reserved list, and be unused.

Slug cases

Taken slug: 409 slug_taken. Reserved slug admin: 409 reserved_slug. Too short, punctuation, or a leading hyphen: 400 invalid_slug.
Settings
Length 3–64 characters
Characters Lowercase letters, numbers, and hyphens
Ends Must start and end with a letter or number

Observed result

A local collision returned HTTP 409. Reserved and pattern failures are the statuses this route returns; they were not submitted again for this page.

What to check

The form lowercases what you type. Leaving the field blank asks the server for a 7-character code instead. admin, api, tools, en, pt, and es are reserved; the full set is in the linked list. A taken slug means that code already exists. Choose another or leave the field blank. Neither result creates a second link.

Caveats

  • The collision status was recorded locally on 11 October 2026. The reserved-slug and invalid-slug bodies are copied from the current route.
  • A blank field is valid. It is not the slug consisting of spaces.

Example files

  • local-response-states.json Inspection aid with the local 201/302 observation and the JSON bodies this route returns. Not a live short link.
  • reserved-slugs.txt Inspection aid listing every custom slug the server rejects as reserved.

Blocked destinations, rate limits, and disabled links

Some requests never become a redirect. A disabled link stops forwarding visitors and does not send them somewhere new.

Cases

A localhost destination is rejected. Creating faster than the window allows is rejected. An unknown code and a disabled code do not redirect.
Settings
Creation limit 10 per 60 seconds and 60 per hour
Client key SHA-256 of the connecting IP, or of user agent plus language if no IP is available
Disabled behavior HTTP 410, JSON error Short link disabled.

Observed result

Local checks returned 400 invalid_url for localhost, 429 with a Retry-After header when the limit was exceeded, 404 for a missing code, and 410 for a disabled code. No sample Retry-After number was recorded.

What to check

The destination must be a public http or https URL of at most 2,048 characters, without a username or password. Localhost, loopback, and private addresses are rejected before the rate-limit counter runs. Over the limit, the API returns 429 and the page says too many links were created from this connection. Email the full short URL and the reason to contact@kitlyapp.com to report an abusive link. Kitly can disable that redirect. Disable is not an edit: visitors then get 410 instead of a replacement destination.

Caveats

  • Links do not expire on their own, and there is no owner dashboard.
  • Do not put secrets in the destination. It is stored and the short link is meant to be shared.
  • These states were not sent to production.

Example files

  • local-response-states.json Inspection aid with the local 201/302 observation and the JSON bodies this route returns. Not a live short link.

Choices that match this shortener

Use a short link for a public page you have already opened. The server stores the destination and answers later requests with a redirect.

Blank slug or custom slug

Use when: Leave the field blank for an automatic 7-character code. Set a slug when a readable name helps and it is still available.

Trade-offs: A custom name is easier to guess and can collide. Reserved words such as admin, api, and tools return 409. The pattern is 3–64 lowercase letters, numbers, or hyphens, starting and ending with a letter or number.

Public HTTPS destination

Use when: The address is http or https, has no embedded username or password, and is not localhost or a private IP.

Trade-offs: A host-only URL is stored with a trailing slash. The check looks at the hostname you submit. It does not vouch for the page, and it does not follow later changes on that site.

Share the destination in words

Use when: The message around the link does not already show where people will land.

Trade-offs: A short code hides the destination. Recipients have to trust the redirect. Keep your own copy of the original URL.

Report a bad link instead of editing it

Use when: A published code points somewhere unsafe or abusive, or you need it to stop redirecting.

Trade-offs: There is no edit, expiry, or delete control. Disabling a link returns 410. It does not let the old code forward to a corrected URL. A QR code of that short link has the same limit.

Messages the form can show

The form shows a localized sentence for the API error code. The sample file has the API's own message.

Problem: Enter a public http or https URL.

Likely cause: The address is missing, too long, uses another scheme, includes a username or password, or names localhost or a private address.

What to do: Open the public https page first, then paste that URL. Localhost and private IPs stay rejected.

Problem: The slug is too short, uses the wrong characters, or is reserved.

Likely cause: Fewer than 3 characters, more than 64, a leading or trailing hyphen, a character other than a lowercase letter, number, or hyphen, or a word on the reserved list.

What to do: Use 3–64 lowercase letters, numbers, or hyphens, starting and ending with a letter or number. If the name is reserved, pick another. The form already lowercases the field.

Problem: That custom slug is already taken.

Likely cause: The code exists in storage. Creating it again returns 409.

What to do: Choose a different slug or clear the field and let the server assign a code.

Problem: Too many links were created from this connection.

Likely cause: This client hash passed 10 creates in the current 60-second window or 60 creates in the current hour. The response is 429 with Retry-After.

What to do: Wait for the window in the Retry-After header. Invalid URL and slug attempts are rejected before they are counted.

Problem: The short link returns 404 or 410.

Likely cause: 404 means the code is missing or the path does not match a 3–64 character code. 410 means the row exists and is disabled.

What to do: Check the code for a typo. A disabled link will not redirect. Report abuse, including the full short URL, to contact@kitlyapp.com. There is no button here to turn your own link back on or point it elsewhere.

Relevant sources

Kitly's status codes follow these HTTP definitions. The exact limits are the ones in this repository.

Frequently asked questions

What does a URL shortener do?

A URL shortener stores a destination on Kitly and turns it into a shorter link that redirects visitors to that URL.

Can I use short links for campaigns?

You can point a short link at a public landing page. Kitly does not provide campaign analytics, expiry, or a self-service editor. Disabled links return 410.

Does the URL shortener need a server?

Yes. Short links need server-side storage and redirects so each short code can point visitors to the original destination URL. File tools on Kitly do not use this path.

Can I edit, expire, or delete a Kitly short link?

No. There is no owner dashboard, no edit control, and no automatic expiry. A disabled link returns HTTP 410 instead of redirecting. To stop an abusive redirect, email the full short URL and the reason to contact@kitlyapp.com.

Why would a custom slug or destination be rejected?

Slugs must be 3–64 lowercase letters, numbers, or hyphens, must start and end with a letter or number, and must not be reserved or already taken. Destinations must be public http or https URLs. Localhost, private addresses, other schemes, and embedded passwords are rejected. Creation is also limited to 10 per minute and 60 per hour for a client.

Continue with a matching live tool or a tested sequence in this language.