See exactly who clicks your links.
SnapURL is a modern URL shortener built for developers and creators who actually want to know what happens after someone clicks their link. Unlike most shorteners that paywall analytics behind expensive plans, SnapURL gives you real, actionable data — referrer, location, device, and timing — for free, from your very first click.
🔗 Live site: snapurl-teal.vercel.app
Most link shorteners were built for a different era of the internet — one where "how many clicks did I get" was enough. Today, creators and developers share the same link across a dozen platforms and have no idea which one actually drove the traffic.
SnapURL was built to answer one question well: where did my audience actually come from?
| SnapURL | Typical shorteners | |
|---|---|---|
| Referrer, geo & device analytics | ✅ | ❌ (paywalled) |
| Generous free tier | ✅ | ❌ (heavily capped) |
| No forced upgrade wall | ✅ | ❌ |
| Simple, non-technical UI | ✅ | ✅ |
- Instant URL shortening — no account required to create a short link
- Custom slugs — pick your own memorable short code
- Fast, cached redirects — Redis-backed caching keeps redirects sub-200ms
- Clean, canonical short links —
snapurl.co/yourslug, not buried under/api/...
- Referrer tracking — see exactly which platform (Twitter, LinkedIn, etc.) drove each click
- Geographic breakdown — country-level insight into your audience, powered by IP geolocation
- Device & browser breakdown — know if your audience is on mobile or desktop
- Clicks-over-time — a real, interactive line chart of activity, so you know when to post
- Live dashboard — every link you own, with click counts, in one place
- Phishing & malware screening — every submitted URL is checked against a continuously updated threat database (40,000+ known-bad domains) before a link is ever created
- Heuristic threat detection — flags punycode/homograph domains, IP-literal URLs, and structurally suspicious patterns even when they're not yet on a blocklist
- Rate limiting — sliding-window limits on link creation and login attempts to prevent abuse and brute-force attacks
- Hardened HTTP headers — CSP, HSTS, X-Frame-Options, and more, configured for real production use
- Secure authentication — powered by Better Auth, with hashed credentials and proper session management
- Full account system — sign up, log in, log out, session-protected dashboard
- Link management — create and delete links directly from your dashboard
- Responsive, accessible design — WCAG AA color contrast, keyboard-navigable, mobile-first layouts throughout
- SEO-ready — per-page metadata, Open Graph tags, sitemap, and robots.txt out of the box
Frontend
- Next.js 16 (App Router)
- TypeScript
- Tailwind CSS v4
- Recharts for data visualization
- Lucide icons
Backend
- Next.js API Routes
- Prisma 7 ORM
- PostgreSQL (Prisma Postgres)
- Upstash Redis — caching & rate limiting
- Better Auth — authentication
Infrastructure
- Hosted on Vercel
- Scheduled background jobs via cron-job.org (click processing, blocklist refresh)
- Geolocation via Free IP API
- Threat data from malware-filter
SnapURL isn't just a CRUD app — a few things worth pointing out under the hood:
- Non-blocking analytics pipeline. Click events are pushed to a Redis queue instantly on redirect, then batch-processed into Postgres by a scheduled job every minute. This means a link's redirect speed is never affected by analytics logging.
- Cached redirects. Link lookups are cached in Redis with a 1-hour TTL, so hot links skip the database entirely after their first hit.
- Layered link safety. Every submitted URL passes through IP-literal detection, a 40k+ domain blocklist (stored as a Redis Set for O(1) lookups), punycode detection, and structural heuristics — all before a link is created.
- Defense in depth on auth. Route protection happens at two layers: a lightweight cookie check in
proxy.ts, and a full database-backed session check inside each protected Server Component.
- Node.js 18+
- A PostgreSQL database (e.g. Prisma Postgres, free tier)
- An Upstash Redis database (free tier)
git clone https://github.com/AsifpMulla123/snapurl.git
cd snapurl
npm installCreate a .env file in the project root:
DATABASE_URL="your-postgres-connection-string"
UPSTASH_REDIS_REST_URL="your-upstash-redis-url"
UPSTASH_REDIS_REST_TOKEN="your-upstash-redis-token"
BETTER_AUTH_SECRET="a-random-32-byte-secret"
BETTER_AUTH_URL="http://localhost:3000"
NEXT_PUBLIC_APP_URL="http://localhost:3000"
CRON_SECRET="a-random-32-byte-secret"npx prisma generate
npx prisma db pushnpm run devVisit http://localhost:3000.
Two routes need to be called on a schedule (e.g. via cron-job.org) with an Authorization: Bearer <CRON_SECRET> header:
| Route | Frequency | Purpose |
|---|---|---|
POST /api/cron/process-clicks |
Every 1 minute | Drains the click queue into Postgres |
POST /api/cron/refresh-blocklist |
Every 6 hours | Refreshes the phishing domain blocklist |
- Custom domains
- Password-protected links
- Link expiration
- QR code generation
- Dark mode
This project is currently unlicensed for public reuse. All rights reserved.
Built with care, one tested feature at a time.