Every feature that keeps your links under control.
Short links, secret sharing, routing rules, trust scoring, analytics, and a multi-tenant agency console — engineered for teams who care what happens after the click.
Smart short links
Branded short links with full lifecycle control — expiration, passphrase protection, custom slugs, and rule-based routing.
Every short link in LinkPilot is a living object, not a frozen redirect. Create it on shrd.link or your own domain, pick a memorable slug, and change the destination later without the URL ever changing — the printed QR code on last year's brochure keeps working. Expiration can be a date and time or a click count, and any link can be gated behind a passphrase that is hashed in the browser before it ever leaves the page. Redirects resolve at the Cloudflare edge, so clicks land in tens of milliseconds worldwide.
In practice: A product team ships a launch campaign with brand.link/launch across email, social, and print. Two days in, the landing page moves — they edit the destination once and every channel, including the printed QR codes, follows instantly.
Branded short links
Custom slugs on your own domain. Edit destinations after sending — the short URL never changes.
Expiration & scheduling
Expire links at a date and time (23:59:59 honored) or after N clicks. Links go dark automatically.
Passphrase protection
Gate any short link behind a passphrase. Hashed client-side; we never see the plaintext.
Custom domains
Cloudflare for SaaS provisioning with per-domain defaults, automatic TLS, and CNAME verification.
Dynamic QR codes
Editable QR codes pointing at any short link. Update the destination without reprinting.
Secret links
Burn-after-read sharing for passwords, credentials, contracts, and files. Engineered for one-time delivery — never marketing analytics.
Secret links exist for the moment a password, API key, or contract has to change hands right now. The payload is written to a table isolated from analytics, and the reveal is atomic: a database row lock guarantees that exactly one viewer can consume a burn-after-read secret, even if two people click at the same instant. Link unfurlers in Slack or Outlook only ever see metadata — a view is recorded solely on an explicit reveal action. Afterward, the payload is overwritten and cannot be recovered, and the full event history stays in the audit timeline.
In practice: An MSP onboarding a new client sends the temporary admin password as a burn-after-read link with a one-hour expiry and a passphrase delivered by SMS. The audit timeline later shows exactly when it was viewed — and that it was viewed once.
Burn after read
Self-destruct after the first reveal. Atomic row-level locking guarantees exactly-once delivery.
Client-side passphrase hashing
Passphrases are SHA-256 hashed in the browser. The server only ever sees the hash.
File attachments
Attach files alongside secret text. 60-second signed URLs scoped to the reveal session.
Reveal timeline
Daily-rotated SHA-256 IP hashes show who opened a secret without storing raw addresses.
Rule Studio & Trust Passport
Route every click intelligently and let recipients verify a link before they trust it.
Rule Studio turns one short link into conditional routing logic you can read out loud: send German mobile visitors to the localized app-store page, everyone else to the web signup. Rules are written in plain English, checked for conflicts, and run through a simulator before you publish. Shadow mode goes further — it evaluates a draft rule against real production clicks without changing where anyone lands, so you can compare outcomes before committing. Trust Passport scores every destination 0–100 and can lock a destination or show a warning interstitial when a target looks risky.
In practice: A growth team A/B tests two landing pages behind one short link, watches the shadow-mode split for a day, then publishes the winning rule — no campaign URLs were changed at any point.
Rule Studio
Route by geo, device, language, referrer, or A/B test. Build rules in plain English, simulate, then publish.
Shadow mode
Test a new rule against live traffic without affecting the destination. Compare outcomes before going live.
Trust Passport
0–100 trust score per link with destination locking and a fallback interstitial for risky redirects.
Privacy-first analytics
Real-time click analytics with no raw IPs, no third-party trackers, and no cross-site profiling.
Every click is recorded server-side at the redirect — no pixels, no cookies on the recipient, no third-party scripts. Dashboards update in real time with country, city, device, OS, browser, referrer, and UTM breakdowns, and bot traffic is fingerprinted and filtered so your numbers reflect humans. Privacy is structural, not a setting: visitor IPs are SHA-256 hashed with a salt that rotates every 24 hours, so raw addresses never touch storage. When a client or stakeholder needs the numbers, share a token-scoped public report URL instead of another seat.
In practice: A marketing lead shares a read-only analytics URL with a client for a campaign wrap-up. The client watches clicks arrive live — without a login, and without the agency exporting a single spreadsheet.
Geo, device, referrer
Aggregated dashboards by country, city, device, OS, browser, referrer, and UTM.
Bot vs human filtering
User-agent fingerprinting separates bot traffic so your numbers reflect real visitors.
Shareable reports
Token-scoped public dashboards. Send a single URL to clients without inviting them to your workspace.
Teams, agencies & API
Multi-tenant by design. Run dozens of client workspaces from one console, or wire LinkPilot into your stack.
LinkPilot is multi-tenant at the database layer: every workspace is isolated by row-level security policies, so one client's links, domains, and analytics are physically invisible to every other tenant. Five built-in roles gate each action through permission checks, and tenant-scoped audit logs record who changed what. The agency console layers up to 25 client workspaces under one $299/mo subscription with white-label branding roll-up and cross-client analytics. The REST API uses lp_live_ keys (SHA-256 hashed at rest) plus signed webhooks, so links and secrets can flow through Zapier, Make, or your own stack.
In practice: An agency onboards its ninth client in an afternoon: new workspace, the client's own branded domain, brand kit applied, and a viewer seat for the client — while the agency dashboard rolls all nine into one report.
Workspaces & RBAC
5 roles (owner, admin, editor, member, viewer) with PermissionGate enforcement on every action.
Agency console
Manage many tenants from one place. White-label branding, member roles, and rolled-up agency-tier billing.
Public API & webhooks
lp_live_ prefixed keys, SHA-256 hashed at rest, with signed webhooks. Zapier and Make compatible.
Frequently asked questions
Is there a free plan?
Yes. Secret links and the free toolset are free forever. Short links, analytics, custom domains, and team workspaces scale with paid plans.
Can I bring my own domain?
Yes. Add any domain via CNAME and LinkPilot provisions a TLS certificate through Cloudflare for SaaS. Set per-domain defaults for branding and behavior.
Do you store IP addresses?
No. Visitor IPs are SHA-256 hashed with a daily-rotated salt before they reach storage. Useful aggregates, no PII.
Are secret link contents used for analytics?
Never. Secret Links and short-link analytics run in separate workflows by design. Secret contents are never indexed, profiled, or used for retargeting.
Ready to control what happens after the click?
Free forever plan. No credit card required.