What Are T.co Links and Why Does Twitter Use Them?
T.co is Twitter's (now X's) proprietary URL wrapping service, active since 2011. Every URL posted on Twitter is automatically converted to a t.co short link — https://t.co/abc123XYZ — regardless of the original URL's length or domain. This applies to all tweets, direct messages, bio links, and notification emails. Twitter wraps URLs in t.co for two core reasons: analytics (click tracking across the platform) and safety (real-time URL scanning before redirect).
When you click a t.co link, Twitter's infrastructure briefly intercepts the request to perform safety checks and record analytics before forwarding you to the destination via HTTP 301 redirect.
Privacy Implications of T.co Click Tracking
Every click on a t.co link records your IP address, device type, browser, geographic location, and timestamp in Twitter's analytics systems. If you are logged into Twitter, this data may be linked to your account profile. Our t.co expander resolves links server-side — only our server IP is recorded, not yours — providing click privacy while still revealing the destination and safety score.
Are T.co Links Safe? Understanding Twitter's URL Scanner
Twitter scans t.co destinations using its own threat detection systems, but newly created malicious links routinely pass through the t.co wrapper before being detected. Our expander adds a second screening layer using Google Safe Browsing and PhishTank, which may identify threats that Twitter's scanner has not yet flagged. This is particularly important for links received via Twitter DMs from accounts you do not know personally.
T.co Links in DMs: Extra Caution Required
Twitter direct message phishing is a well-documented attack vector. Compromised accounts send DMs containing t.co links to their followers, directing them to credential-harvesting pages or malware downloads. The t.co domain provides false legitimacy since recipients recognise it as Twitter infrastructure. Always expand t.co links received unexpectedly via DM before clicking. See our social media manager URL guide and security guide for more context.