Back to Blog

How Self-Destructing Links Actually Work (and When to Use Them)

•PVTLNK Team

A link that never expires isn’t a feature. It’s a decision nobody made on purpose.

Most shorteners default to permanent. You paste a URL, get a short one back, and that link works forever unless you manually go delete it — which, in practice, almost nobody does. Six months later it’s still live, still resolving, still findable, long after whatever it pointed to stopped being relevant or private.

We built self-destructing links because we think permanence should be something you opt into, not something you have to remember to undo.

How it actually works

When you set an expiration on a link, we store an expires_at timestamp alongside it. Once that time passes, the link stops resolving — visitors get a 404, not a redirect. There’s no grace period, no “still works if you have the direct link,” no cached version floating around. The link is just gone.

You can also set a fallback URL for expired links. Instead of a dead end, visitors get redirected somewhere useful — your homepage, a “this offer has ended” page, whatever makes sense. It’s a small thing, but it’s the difference between an expired link feeling intentional versus broken.

When this actually matters

A few situations where we’ve seen expiration used well:

  • Time-boxed offers. A discount code link that should stop working the moment the sale ends, without anyone having to remember to disable it.
  • One-time document shares. A link to a confidential file that should exist for exactly as long as the recipient needs it, and not a day longer.
  • Event registration. Links that make sense for exactly as long as the event is upcoming.
  • Anything sensitive. Tip lines, incident reports, anything where “this link still works two years later” is a liability, not a convenience.

The common thread isn’t that these links are secret. It’s that they have a natural lifespan, and leaving them live past that lifespan doesn’t help anyone — it just adds one more thing that could leak later.

What expiration doesn’t fix

Setting an expiration date doesn’t retroactively protect clicks that already happened, and it doesn’t stop someone from screenshotting the destination before the link dies. It’s not a security control by itself. It’s a cleanup mechanism — one less permanent artifact sitting around with your name on it.

Combined with the rest of how PVTLNK works — client-side encryption, hashed IPs, no email requirement — expiration is one piece of a broader default we believe in: your links should do what you need them to do, and then stop existing. Not sit around indefinitely because deleting them was never anyone’s job.