How a Click short link
is made and shown.

What is kept

No click tracking beyond a per-link counter. No visitor data is stored. The counter is one number per link — how many times its preview page has been served. It holds no time, no address and no browser. The privacy page lists every file the server writes.

How a link is made

The form on the Click page sends one request to labs.llc’s own endpoint, /click/api/shorten.php. So do the short-link bands on Network Labs and Network, which make Click links too. The endpoint accepts a POST with a JSON body from labs.llc’s own pages and nothing else: a request from another origin is refused before the address is read. Then, in order:

1. If making links has been paused, the request is refused with a sentence that says so. Links already made keep opening.
2. The address is checked against the rules in the terms. A refused address gets a sentence saying which rule refused it. Nothing is written.
3. The host is checked against the blocklist, a text file the people who run Click edit by hand.
4. The request is counted against the limit of 10 links an hour and 40 a day from one address, and against the ceiling of 200 a day across the whole site.
5. The link is written to the store under a new code.

An address that already has a short link gets the same one back, so one destination has one code and one counter.

The code

A code is seven characters drawn from an alphabet of 28: 23456789bcdfghjkmnpqrstvwxyz. It has no 0, 1, i, l or o, so a code read from paper cannot be mistyped as a look-alike, and no a, e or u, so a code cannot spell a word — or the name of one of Click’s pages. That gives 13,492,928,512 possible codes. Each character comes from PHP’s random_int, which the PHP manual describes as cryptographically secure and uniformly selected, and a new code is checked against every code in the store, and every blocked one, before it is used. Codes are lower case; a link typed in capitals still opens.

The store

There is no database. The store is one text file that is only ever added to: one line per link, holding the code, the time and the destination. A write takes an exclusive lock on the file, so two links made in the same instant cannot take the same code or run their lines together. The file sits in a folder labs.llc’s web server is told to refuse, so it cannot be downloaded. It holds up to 50,000 links; past that the endpoint says the store is full.

Nothing in the store is rewritten. A link is withdrawn by adding its code, or its host, to the blocklist. From then on the link answers “410 Gone” with a page that says it is blocked, and its destination is no longer shown.

The preview

Opening a short link runs the same checks again on the stored address before anything is shown — a line in a file is not proof that it once passed. The page then prints the destination, the host, the date and the counter. Every character of the address is escaped before it is printed, so an address cannot add markup or script to the page.

The Continue button is an ordinary link marked nofollow noopener noreferrer. In the HTML Standard’s terms: Click does not endorse the destination, the destination gets no handle on the page you came from, and no Referer header is sent, so the destination is not told that you came from Click. The preview page is marked noindex, and it carries no analytics tag.

A host in non-Latin letters is shown in punycode, the ASCII form defined in RFC 3492 that a browser actually asks for, and that is the form printed in bold and in the preview’s headline. Its Unicode form appears only beside it, with a warning: two hosts that look the same in Unicode have different punycode.

What the server never does

It never opens a destination. There is no link checker, no title or thumbnail scraper and no DNS lookup in the code. That keeps the server from being used to reach machines it should not reach, and it sets the limit of what Click can tell you: which site a link leads to, not whether the site is safe.

From click.com.im to labs.llc

Click was built as a site of its own at click.com.im and came in-house to labs.llc in build 546. Every address on the old name now answers one permanent redirect to the same place here: click.com.im/<code> to labs.llc/click/<code>, the same preview of the same link. The rules, the alphabet, the limits and the store’s format did not change. Five things were added: labs.llc’s /click/ and the old name are both refused as “Click itself”; notime.llc and labs.llc’s own redirecting short links (labs.llc/<code>, labs.llc/labluxa/<code>) joined the refused shorteners; the preview’s headline names an international host in punycode, never in look-alike Unicode; a ceiling of 200 requests a day across the whole site sits beside the per-address limit; and making links can be paused without touching a single existing link.

Sources

Read on 28 September 2026 (UTC):

• WHATWG URL Standard, “ends in a number checker”: a host whose last label is a number is parsed as an IPv4 address. It is why Click refuses 2130706433 and 0x7f.1 as well as 127.0.0.1. The same standard lists credentials and a backslash in place of a slash as validation errors. Living Standard, last updated 10 September 2026.
• RFC 6761, Special-Use Domain Names, sections 6.2 to 6.5: test, localhost, invalid and the example domains.
• RFC 6762, Multicast DNS, section 3: names ending in .local are link-local, meaningful only on the network where they originate.
• RFC 3492, Punycode.
• HTML Standard, link types: nofollow, noopener and noreferrer. Living Standard, last updated 28 September 2026.
• PHP manual, random_int: “Get a cryptographically secure, uniformly selected integer”.
• labs.llc’s own portfolio register, the Notime row, which describes notime.llc as permanent short links served as 301 redirects — the reason notime.llc is refused as another shortener.

The other suffixes Click refuses are its own rule, not a quotation from a standard. The list of shortener hosts and how each was read is in the terms.

Who runs it

Click is part of labs.llc, and its store lives on labs.llc’s own server. Write to labs@labs.llc. The terms, privacy note and copyright for the whole site are on the legal page.