Every feature, working for real

No mockups, no placeholder screens. Every item below is connected to live application logic and your actual database.

Link engine

Redirect resolution is cache-first and SSRF-hardened. Expiry dates, click limits, and disabled states are enforced before every redirect.

  • Atomic alias uniqueness across namespaces
  • UTM parameter injection
  • Destination editing without changing the short URL
  • 301/302 configurable

Analytics

Real click records with bot classification, device, OS, browser, referrer and country data — aggregated into charts with date filters.

  • Human vs. bot separation
  • Top links, devices, referrers, countries
  • Per-link analytics pages
  • CSV export

Security

Security is structural, not decorative: every destination is validated, every admin action is audited, every password is hashed.

  • SSRF & private-IP blocking
  • CSRF on every form
  • Rate-limited login and unlock flows
  • TOTP two-factor authentication

Subscriptions

Plans are fully configurable from the admin panel — price, currency, duration, capacity, features and trial eligibility.

  • Never break existing links on expiry
  • Transaction-safe capacity allocation
  • Grace periods
  • Upgrades & renewals

Payments

Modular gateway architecture. Each adapter verifies payments server-side and all webhooks are idempotent.

  • Stripe & PayPal
  • SSLCommerz, bKash, Nagad
  • Manual transfer review
  • Duplicate payment prevention

Developer API

Authenticated with hashed private keys, scoped per endpoint, rate-limited and idempotent.

  • Bearer key authentication
  • Idempotency-Key header
  • Usage logs & key rotation
  • Interactive API docs