Open Redirect Checker

An open redirect is a security vulnerability that occurs when a web application accepts user-supplied input (typically via query parameters like ?url=,?redirect=, or?next=) and uses that input to redirect the user to another URL without proper validation. Attackers exploit open redirects to create convincing phishing URLs - the link appears to point to a legitimate domain (e.g., legitimate-bank.com/login?redirect=https://evil.com), but the user is silently redirected to a malicious site. Open redirects are classified as CWE-601 (URL Redirection to Untrusted Site) and are a common finding in OWASP Top 10 security assessments.

1. URL Parsing & Parameter Analysis: The tool parses the URL and extracts all query parameters. Each parameter name is checked against a database of 40+ known open redirect parameter names. Parameter values are analyzed to determine if they contain URLs, external domains, IP addresses, or encoded payloads.
2. Payload Testing: For each known redirect parameter found, the tool appends 14 different open redirect bypass payloads and sends HEAD requests from your browser with redirect: "manual" to intercept any redirects. Browsers report such a redirect without its status code or Location header, so a payload that triggers one is marked inconclusive - verify where it points with curl -sI. Sites that block cross-origin requests cannot be tested this way.
3. Redirect & Shortener Analysis: The tool checks whether the URL itself redirects (and where to, when the sites involved allow cross-origin requests) and checks for known URL shortener domains. Shortened URLs and URLs that redirect to external domains are flagged as they can be used to obfuscate the final destination.
4. Risk Assessment: All findings are combined into a severity-based assessment. High-risk parameters accepting external URLs, or a URL that itself redirects to an external domain, receive a high rating. URLs with redirect parameters that may accept URL values receive a medium rating. Payloads that triggered a redirect are listed as inconclusive for you to verify.

• Protocol-Relative URLs: Using //evil.com instead of https://evil.com to bypass checks that look for http://.
• Credential Confusion: Using https://[email protected] where the browser interprets evil.com as a username and redirects to the attacker's server.
• Double Encoding: Using percent-encoded characters to bypass simple pattern matching. For example, %68%74%74%70://evil.com decodes to http://evil.com.
• Backslash Bypass: Using backslashes instead of forward slashes, like \\evil.com, which some URL parsers interpret differently than forward slashes.
• Data URI & JavaScript Schemes: Using data: or javascript: URIs to execute code or redirect in ways that bypass HTTP-based validation.

Our Open Redirect Checker runs entirely in your browser. URL parsing, parameter analysis, and payload generation happen client-side. Payload testing sends HEAD requests directly from your browser to the target server - we do not proxy, store, or log any URLs you test. The tool is 100% free with no signup, no account, and no usage limits.

Important limitations:Browsers never let a web page read the Location header of a redirect, so a payload that triggers a redirect is reported as inconclusive rather than confirmed, and sites that don't allow cross-origin requests cannot be tested live at all - those payloads are reported as untested rather than safe. Verify flagged payloads with curl -sI or an intercepting proxy such as Burp or ZAP. The tool tests for the most common open redirect patterns but cannot guarantee detection of all possible bypass techniques. A test result indicating no vulnerability does not guarantee that the URL is safe - it means no common open redirect pattern was detected. For comprehensive security testing, use this tool alongside manual code review and dedicated security scanners.