Self-Destructing Links That Disappear After Use

Three switches, and they stack

Most "self-destructing link" tools give you one behaviour: burn after reading. zip1.io gives you three independent controls on the same short link, and you can set any combination of them when you create it.

Set two and the stricter one wins: a link with max-clicks: 5 and a Friday expiry dies on the fifth click or on Friday, whichever comes first. The checks run in that order at redirect time — cap, then expiry, then password — which is why an expired link never bothers showing the password prompt.

If you only want the single-use case, the dedicated walkthrough is on one-time links. This page is about the other two axes and how they combine.

Set an expiry date in the browser

Paste your URL on the home page, click Advanced Options, and fill in Expires at. It is an ordinary date-and-time picker showing your local timezone; the page converts it to UTC before submitting, so a 6pm expiry means 6pm where you are.

Two fields sit right next to it — Max clicks and Password — and nothing stops you filling in all three. Then click Shorten.

The expiry has to be at least five minutes ahead. A timestamp in the past, or one four minutes out, is rejected rather than silently accepted as an already-dead link.

…or from the API, in one request

No key, no account, 10 link creations per minute per IP:

curl -X POST https://zip1.io/api/create \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://drive.example.com/q4-board-pack.pdf",
    "alias": "board-q4",
    "expiration-time": "2027-01-31T18:00:00Z",
    "max-clicks": 12,
    "password": "board2027@"
  }'

# Response:
# {"short_url": "https://zip1.io/board-q4", ...}

expiration-time must be ISO 8601 with a timezone — 2027-01-31T18:00:00Z or 2027-01-31T19:00:00+01:00. A naive timestamp with no offset is rejected, because "6pm" without a timezone is not a moment. Passwords need at least 8 characters including a letter, a digit and one @ or ., and no two of those special characters in a row.

Full parameter list and error codes are in the API docs.

What "disappears" actually means

This is where most pages on this topic get vague, so plainly:

• The redirect stops. Once the cap or the expiry is passed, the short URL serves an expired-link page instead of sending anyone onward. That is the whole mechanism, and it is enforced on our side on every request — there is no client-side timer to bypass.
• The record is not deleted. The link stays in our database and https://zip1.io/stats/<slug> keeps working, so you can still see how many people made it through before the door closed, and from where.
• The destination is untouched. zip1.io never had control over the page or file at the far end. Expiring the short link closes one route to it; the original URL still works for anyone who has it. If the destination itself must go away, revoke it at the source too.
• It cannot be undone or extended. Links are immutable after creation. That cuts both ways: you cannot rescue a link that expired early, and nobody can quietly re-point a link you already handed out.

One practical wrinkle on click caps: preview crawlers count. Paste a capped link into Slack, Discord or iMessage and the platform may fetch it once to render a card, spending a click before your recipient sees it. The one-time links page has the workarounds; the stats page tags bots separately, so you can at least tell after the fact what ate the click.

Private link sharing: what this is, and what it isn't

Short-lived and unguessable is genuinely useful. It is not the same as private, and it is worth knowing exactly where the line falls.

Without a password, the stats page is public. Anyone who has the slug can open /stats/<slug> and read the destination URL, along with the click history — including after the link has expired. If the destination URL is itself the secret (a signed download link, a pre-filled form, an internal dashboard), set a password. The same password then gates the redirect and the stats page, and the destination stops being readable to anyone without it.

We can read the destination. zip1.io stores it in plaintext, because a redirect service has to know where it is redirecting you. Passwords are stored as bcrypt hashes, so the passphrase itself is not recoverable from our database, but the URL is. For material where a third party must not be able to read it at all, use an end-to-end encrypted tool — OneTimeSecret, Privatebin, or an encrypted file transfer — and consider shortening that link if you need it to fit on a slide.

A password is a gate, not encryption. It stops a casual opener, a forwarded link, and a crawler. It does not protect against someone who already has both the link and the password, and it does not stop the recipient from copying the destination once they are through. More on the mechanics and the honest limits on password protected links.

Four things people actually do with this

How the shorteners compare on expiry

Comparison reflects publicly documented free-tier features at time of writing. Dedicated secret-sharing tools like OneTimeSecret and Privatebin are a different category — they host the secret and encrypt it, rather than redirecting to a URL you control. Use those when the payload is the secret; use this when the destination is a page or file of your own.

FAQ

• What is a self-destructing link?

  A short URL that stops working on its own. On zip1.io that means a click cap (max-clicks), an expiry timestamp (expiration-time), or both — whichever comes first ends the link, and later visitors get an expired-link page.

• How do I set an expiry date?

  Advanced Options → Expires at on the home page, in your local timezone. Via the API, pass expiration-time as ISO 8601 with a timezone, e.g. 2027-12-31T23:59:00Z. It must be at least five minutes in the future.

• Does the destination get deleted?

  No. The redirect stops; the record, the analytics, and the page or file at the far end all stay exactly as they were. Expiring a short link closes one route to the destination, not the destination itself.

• Is a self-destructing link private?

  Unguessable and short-lived, which isn't the same thing. Without a password, /stats/<slug> is public and shows the destination URL. Add a password and both the redirect and the stats page require it.

• Can I combine expiry, a click cap and a password?

  Yes — they're independent and they stack. The cap is checked first, then the expiry, then the password, so an expired link never shows the password prompt. max-clicks: 1 plus a 24-hour expiry is a common pairing.

• Can I extend a link after it expires?

  No. Links are immutable once created, so mint a new one and re-share. The upside of that rule: a link you handed out can never be quietly re-pointed somewhere else.

• Is it free?

  Yes. No signup, no monthly link cap, and no paid tier gating expiry or passwords. The API allows 10 link creations per minute per IP.

Related