TinyLink — Short Links That Do the Whole Job

Project Overview

Most URL shorteners stop at the redirect. TinyLink handles the parts you actually run into afterwards — the link that needs to expire, the one that should not be public, the one whose destination changed after it was already printed.

It is a single PHP application with no build step: no Composer, no Node, no daemon. Upload the folder to any host with PHP 8.1 and PDO, point it at SQLite or MySQL, and it runs. That constraint is the interesting part — everything below is implemented without reaching for a dependency.

What it does#

• Editable destinations. Links stay editable after they are shared, so a destination can change without reprinting anything. This is why redirects are served as 302 rather than 301.
• Analytics that stay honest. Clicks over time, referrers, browsers, devices and countries — with bot and preview traffic separated out, and visitor IPs stored only as salted hashes.
• QR codes generated in-process, as SVG or PNG, rather than proxied from a third-party image service that can disappear and take every printed code with it.
• Expiry and limits. Give a link a shelf life: expire on a date, cap it at a number of clicks, or switch it off.
• Password-protected links, where the destination never appears in the page source until the password checks out.
• Link-in-bio pages with themes, per-block click counts and their own QR code.
• A REST API with bearer-token auth, full CRUD, per-link daily time series, and 120 req/min rate limiting that returns a proper Retry-After on 429. API keys are stored as SHA-256 digests, never in the clear.

The self-hosting story is the point rather than a footnote: run your own copy and the domain, the database and the analytics are yours, and the links keep resolving for as long as you keep the domain.