Addresses / Pair 04 of 41
The redirect and the string it stands in for
Short links are easy to carry and impossible to verify. That is not a trade-off between two goods. It is the entire difference between the two things on this page.
Reading it the wrong way round
A promise about an address
Something short, memorable and typed by a person: a domain that redirects, a service with a slug on the end, a QR code, a phrase people pass around. It points somewhere today. Where it points tomorrow is decided by whoever operates it.
The address itself
Fifty-six characters of base32 and then .onion. This is not a pointer to a service, it is the name of a key the service has to hold. Nobody can repoint it, including the person who gave it to you.
Most people rank these the wrong way round on first meeting, and they do it for a reasonable-sounding reason. The short form is easier to hold in your head, easier to write down, and much harder to mistype. Fewer characters means fewer chances to slip. All of that is true, and none of it touches the question that matters.
A long string is not hard to handle. Nobody types fifty-six characters by hand, and a string you paste in one action is not more error-prone than a string you paste in one action. The difficulty people are avoiding is imaginary, and the safety they are giving up in exchange is not.
A promise against a string
A short link is a redirection somebody else operates. It resolves to whatever its owner set last, and its owner can change that at any moment for any reason. It can send you to the right place for a year and somewhere else on the day it becomes worth doing, and it will look identical to you on both sides of that change. Nothing in the short form carries a proof, so there is nothing for you to compare it against.
The full address carries a proof and carries it permanently. The characters come out of a public key, so an answer at that address requires the matching private key. A short link says trust me. An address says check me, and hands you the thing to check it with.
This is also why the two get muddled with mirrors and copies. A short link that lands on a copy looks exactly like a short link that lands on a mirror, and you will not see the difference at any point in the journey unless you look at where you ended up.
Sixty-two characters, or it is not an address
Count before you trust
Count what you are holding. Fifty-six base32 characters plus .onion is an address. Anything shorter is a promise made by whoever runs it, and promises are not comparable to a published set.
- Look at what you were given. If it is short enough to read aloud comfortably, it is not an address.
- Resolve it yourself and capture the full string you land on, in full, from the address bar.
- Compare that string against a published set, middle included rather than opening characters only.
- Keep the full string and discard the short one. Once you hold what it pointed at, the pointer has no remaining value.
- A clearnet domain whose only job is to bounce you somewhere else.
- A link service with a slug, where the visible text and the destination have no relationship at all.
- A QR code, which hides everything by design and is read by a machine that will not pause to let you check.
- A memorable phrase or nickname that people circulate as though it were official. Names are not addresses and nobody owns them.
- A link in a message where the text you can see and the target underneath were written by different people for different purposes.
Where the short link can be moved
| Question | A shortened link | The full address |
|---|---|---|
| Who decides where it goes? | Whoever runs it, at any moment | Whoever holds the key, and only them |
| Can you check it against a set? | No. It is not in one and cannot be | Yes, character by character |
| What if it gets repointed? | You follow it and never notice | It cannot be repointed |
| How long is it? | Short enough to remember | Sixty-two characters with the suffix |
| What does it prove? | Nothing at all | That the answering service holds the key |
- If you treat a shortened link as the address
- You store a pointer you have no way to check and re-trust its owner every time you use it. One quiet change at their end redirects you into a copy, and you will follow it happily.
- If you treat the address as a shortened link
- You fail to keep the full string, go back to the short form for convenience, and never compare anything. You end up relying on whatever handed it to you, over and over.
Two different jobs for you
- If it is a shortened link
- Follow it once, capture the full string it lands on, compare that against a published set, and save the result. Then stop using the short form entirely.
- If it is the address
- Store it whole somewhere you control, and compare it in full each time before you act on it. Storing it is not the same as checking it.
One habit removes most of this. Never keep a short form as your record of anything. Keep strings, compare strings, and let the convenient version be something you use once and throw away. The tests index collects the separating checks from every pair, and if your saved string has stopped matching, a changed list against a bad copy is the page for that.
Questions readers send about this pair
Why do people use short links at all?
They fit in speech, in print and on a phone screen, and they survive being read out. Convenience is real. It just belongs at the moment of finding an address, not at the moment of using one.
Is a QR code safer than a link?
It is worse in the way that counts. A link at least shows you something before you commit, while a code shows you nothing and hands the destination straight to a machine. Whatever it resolves to still needs comparing.
Can a short link be checked at all?
Only by following it and looking at where you arrive, which means you are checking the address rather than the link. The short form stays uncheckable no matter how many times it has behaved.