URL Unshortener & Redirect Resolver

Resolve shortened URLs to their final destinations and show the full redirect chain. Handy for affiliate marketers, security teams, and analysts.

Input

Field	Description
Paste URLs (one per line)	Paste one URL per line. Used only when no file or URL is provided.
Upload URLs file	Upload a text file with one URL per line.
URLs list URL	Public URL of a text file with one URL per line. Used only when no file is provided.
Timeout per URL (seconds)	Total time for redirects and HEAD-to-GET fallback, from 5 to 60 seconds; default 15.
Max URLs	Maximum valid URLs to resolve, from 1 to 2000; default 1000.
Max redirects	Maximum redirects to follow per URL.

Inputs must satisfy maxUrls × timeoutSec / 10 ≤ 1800 (a 30-minute resolution budget with ten workers). For example, timeoutSec: 60 allows maxUrls up to 300. Invalid lines produce error records without a per-URL charge; these records are capped at maxUrls per run. A source with zero valid URLs fails before charging. Duplicate normalized URLs are resolved once.

Only HTTP and HTTPS destinations on ports 80 and 443 are allowed, including redirects and the URL of an input file. Private and other non-public addresses are blocked. URLs are limited to 8192 characters. Internationalized hostnames use UTS #46 non-transitional ASCII normalization, and URL username/password credentials are stripped before requests and publication. Query parameters are preserved.

Resolution follows HTTP redirects only. JavaScript redirects and <meta http-equiv="refresh"> redirects are not followed. HTTPS-to-HTTP redirects are followed when the destination passes the same checks.

Output

• Dataset: URL result records with url, finalUrl, redirectCount, redirectChain, status, error, plus invalid-line error records. Each chain entry includes the raw Location in to (with credentials stripped) and the normalized joined destination in target. Errors preserve the chain completed so far and the last URL that returned a response in finalUrl; a blocked redirect target is recorded separately in blockedAt.
• Key-value store SUMMARY: JSON totals

Invalid input lines are skipped. Actor memory is capped at 1024 MB.

Dependency maintenance

requirements.in pins the direct dependencies, and requirements.txt locks all dependencies with SHA-256 hashes. Rebuild and audit the lock with Python 3.11:

uv pip compile requirements.in --python-version 3.11 --generate-hashes -o requirements.txt
python -m pip install --require-hashes -r requirements.txt
pip-audit --require-hashes --disable-pip -r requirements.txt

The Docker base is pinned to the Linux/amd64 Python 3.11 manifest published on Docker Hub. Verify the registry digest when updating it, then rebuild and test the container. The memory cap uses the official maxMemoryMbytes Actor setting.

Offline tests

Use Python 3.11 to prepare a test environment once:

python3.11 -m venv .venv-test
.venv-test/bin/python -m pip install -r test/requirements.txt
PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv-test/bin/python -B -m pytest -p no:cacheprovider -s -q test

The suite uses mocked sockets, DNS, and Apify storage and charging. Any unmocked network connection fails the test; the suite requires no network access once its test dependencies are installed.