- Shortest code
- 5 characters
- 5-character links
- 100 / day
- Devices & referrers
- —
- Countries & browsers
- —
- Individual click log
- —
- Grace period if you lapse
- —
Edge redirects · 2026
A link short enough to say out loud.
Paste anything. Get back three to six characters that fit on a business card, in a podcast script, or under a QR code — screened against Google Safe Browsing before it exists.
Departures
Live
From
https://example.com/spring-campaign/landing?utm_source=print
w8.nz/
✓ Safe Browsing
✓ Bot checked
✓ 302, never cached
Length
GUEST
Ready
0 ms
Median redirect
0+
Edge locations
0
Threat lists checked
$0
To start
How it works
Three steps, one of which is optional.
Nothing about this needs an onboarding flow. The interesting work happens in the second step, and it happens before your link is allowed to exist.
01
Paste the long one
Any http or https address up to 2,048 characters. Signed out you get six characters, which is enough for fifty-six billion links; an account brings that down to five, and a paid plan to four or three.
No account required
02
We check it before it exists
The destination is sent to Google Safe Browsing and matched against four threat lists — malware, social engineering, unwanted software and harmful applications. Cloudflare Turnstile confirms there is a person on this end. Only then is a code generated, and only after we have confirmed it collides with nothing.
Roughly 300 ms, once
03
Share it and watch
Every click is answered from whichever edge location is closest to the person clicking, then recorded: country, device, browser, referring host. Your dashboard keeps the last hundred clicks per link and fourteen days of daily totals.
No cookie on the visitor
Lengths
Shorter is the whole product.
Each character you remove makes the link easier to read aloud, print smaller and scan faster. This is what every tier actually buys you.
w8.nz/a4f9Kq
w8.nz/a4f9K
w8.nz/a4f9
w8.nz/a4f
Every address on the internet is a different length. Yours does not have to be. Three to six characters · w8.nz
Under the hood
Decisions we already made for you.
A shortener is a piece of trust infrastructure. These are the parts that matter, stated plainly rather than badged.
Screened before it exists
The Safe Browsing check runs at creation, not at click time, so a malicious destination never gets a code in the first place. Reported links are retired by hand and their codes are never reissued.
Hashed, salted, versioned
PBKDF2-SHA256, 300,000 iterations, unique salt per account, and the cost is recorded on the record so it can be raised later without locking anyone out. TOTP secrets and backup codes never leave storage in a readable form.
302 by design
A 301 is cached by the browser permanently: your counter stops moving after the first click, and a link you delete keeps working for anyone who already followed it. We take the round trip and keep control of the link.
Analytics without tracking
We record what Cloudflare already tells us about a request — country, device class, browser, referring host — and nothing else. No cookie is set on the person clicking and no identifier follows them off the page.
Pricing
Pay for shorter, not for basics.
Analytics, Safe Browsing, 2FA and QR codes are on every tier including the free one. What money buys is code length and volume.
Monthly
Annual
Save up to 58%
| Plan | Free $0$0 ForeverForever | Plus $2.99 / month$19.99 / year Saves 44% | Pro $9.99 / month$49.99 / year Saves 58% |
|---|---|---|---|
| Shortest code | 5 characters | 4 characters | 3 characters |
| Shortest per day | 100 | 100 | 100 |
| 5-character links | 100 / day | 1,000 / day | Unlimited |
| Click totals | ✓ | ✓ | ✓ |
| Devices & referrers | — | ✓ | ✓ |
| Countries & browsers | — | — | ✓ |
| Individual click log | — | — | Last 20 |
| QR codes | ✓ | ✓ | ✓ |
| Safe Browsing & 2FA | ✓ | ✓ | ✓ |
| Grace period if you lapse | — | 7 days | 7 days |
- Shortest code
- 4 characters
- 5-character links
- 1,000 / day
- Devices & referrers
- ✓
- Countries & browsers
- —
- Individual click log
- —
- Grace period if you lapse
- 7 days
- Shortest code
- 3 characters
- 5-character links
- Unlimited
- Devices & referrers
- ✓
- Countries & browsers
- ✓
- Individual click log
- Last 20
- Grace period if you lapse
- 7 days
On every plan Shortest per day · 100Click totalsQR codesSafe Browsing & 2FA
Payment runs through Vapih Pay; card details never reach Waitin Zone. Cancel any time from the billing portal — your plan stays active until the period you already paid for ends.
Questions
Answered properly.
Including the ones with an awkward answer.
Yes, and it stays that way. Five-character links, a hundred a day, click counts on every one, and Google Safe Browsing on every destination. No card, no trial clock, no feature that quietly stops working after a fortnight.
Nothing, for a week. Your links keep working through a seven-day grace period. On days eight to fourteen they show a "paused" page rather than redirecting — the code is still yours and renewing brings everything straight back. Only after fourteen days is the link deleted and the code returned to the pool.
The lookup runs at whichever Cloudflare location is nearest the person clicking, so the redirect itself is typically 20-40 ms plus your own network latency. We send a 302 rather than a 301 on purpose: a permanent redirect gets cached by the browser forever, which stops your click counter moving and keeps a link alive even after it has been removed for abuse.
Passwords go through PBKDF2-SHA256 at 300,000 iterations with a per-account salt, and the cost is versioned so it can be raised later without invalidating anyone. Two-factor authentication is RFC 6238 TOTP with ten single-use backup codes, stored only as hashes. Changing your password signs out every device, and failed sign-ins are rate limited per account and per network.
Free shows the total. Plus adds devices and referrers. Pro adds countries, browsers and the last twenty individual click records. We store the last hundred clicks per link — country, device type, browser and referring host. No cookies are set on the person clicking, and no identifier follows them anywhere.
No. The box above works signed out and gives you a six-character link, fifty a day per network. An account is what gets you shorter codes, a dashboard, and the analytics behind each link.
Your next link could be three characters long.
Free forever, no card, and the first one takes about eight seconds.