Open Redirect Checker

An open redirect is a security vulnerability that occurs when a web application accepts user-supplied input (typically via query parameters like ?url=,?redirect=, or?next=) and uses that input to redirect the user to another URL without proper validation. Attackers exploit open redirects to create convincing phishing URLs - the link appears to point to a legitimate domain (e.g., legitimate-bank.com/login?redirect=https://evil.com), but the user is silently redirected to a malicious site. Open redirects are classified as CWE-601 (URL Redirection to Untrusted Site) and are a common finding in OWASP Top 10 security assessments.

1. URL Parsing & Parameter Analysis: The tool parses the URL and extracts all query parameters. Each parameter name is checked against a database of 40+ known open redirect parameter names. Parameter values are analyzed to determine if they contain URLs, external domains, IP addresses, or encoded payloads.
2. Payload Testing: For each known redirect parameter found, the tool appends 14 different open redirect bypass payloads and sends HEAD requests to the server with redirect: "manual" to intercept any redirects. If the server redirects to an external URL in response to a payload, a vulnerability is confirmed.
3. Redirect Chain & Shortener Analysis: The tool follows the URL's own redirect chain (if any) and checks for known URL shortener domains. Shortened URLs and URLs that redirect to external domains are flagged as they can be used to obfuscate the final destination.
4. Risk Assessment: All findings are combined into a severity-based assessment. Confirmed vulnerabilities through payload testing receive a critical rating. High-risk parameters accepting external URLs receive a high rating. URLs with redirect parameters but no confirmed exploit receive a medium rating.

• Protocol-Relative URLs: Using //evil.com instead of https://evil.com to bypass checks that look for http://.
• Credential Confusion: Using https://evil.com@valid.com where the browser interprets evil.com as a username and redirects to the attacker's server.
• Double Encoding: Using percent-encoded characters to bypass simple pattern matching. For example, %68%74%74%70://evil.com decodes to http://evil.com.
• Backslash Bypass: Using backslashes instead of forward slashes, like \\evil.com, which some URL parsers interpret differently than forward slashes.
• Data URI & JavaScript Schemes: Using data: or javascript: URIs to execute code or redirect in ways that bypass HTTP-based validation.

Our Open Redirect Checker runs entirely in your browser. URL parsing, parameter analysis, and payload generation happen client-side. Payload testing sends HEAD requests directly from your browser to the target server - we do not proxy, store, or log any URLs you test. The tool is 100% free with no signup, no account, and no usage limits.

Important limitations: Browser CORS restrictions may prevent the tool from reading redirect headers on some servers, which can cause payload tests to report as untested rather than safe. The tool tests for the most common open redirect patterns but cannot guarantee detection of all possible bypass techniques. A test result indicating no vulnerability does not guarantee that the URL is safe - it means no common open redirect pattern was detected. For comprehensive security testing, use this tool alongside manual code review and dedicated security scanners.