URL Shortener (e.g. bit.ly)

Problem statement

Design a service that takes long URLs and returns short aliases. When users visit the short URL, they are redirected (HTTP 302/301) to the original URL. The system must be highly available for reads (redirects), low latency globally, and collision-free for codes.

Stretch goals: custom aliases, analytics (click counts, geography), expiration, abuse prevention.

How it works (plain English)

1. User submits https://example.com/very/long/path?....
2. Service generates a short code (e.g. 7 characters from [A-Za-z0-9]) or validates a custom alias.
3. Store mapping code → long_url (and metadata).
4. On GET /{code}, look up the long URL and return 302 (temporary) or 301 (permanent) redirect.

Analogy: A hotel gives you room 204 instead of saying “second floor, east wing, third door past the ice machine.” The number is the short code; the full path is the long URL.

Requirements

High-level design

Rendering diagram…

Components explained — this design

Shared definitions: 00-glossary-common-services.md

• Writes (create URL): authenticated API path, validation, rate limits.
• Reads (redirect): separate lightweight redirect tier at the edge when possible (cache), else fast KV lookup.

End-to-end flows

Create short URL (write path)

Rendering diagram…

Sequence diagram — components

Resolve redirect (read path)

Rendering diagram…

Low-level design (deep dive)

Short code generation

• Preferred: random base62, length 7+ → ~3.5 trillion space; check uniqueness with conditional write in DynamoDB (attribute_not_exists(pk)).
• Alternative: Snowflake-like ID encoded in base62 (time-ordered, no DB round-trip for uniqueness if clock+machine ID unique).
• When to use which: Random for simplicity; Snowflake when you want sortable URLs or avoid hot partitions on write (with sharded counters).

Storage (AWS-flavored example)

CDN for redirects

• CloudFront with Lambda@Edge (optional): block countries, rewrite expired links, A/B landing pages.
• Caveat: 302 vs 301: 301 can be cached aggressively by browsers; if destination changes often, prefer 302.

API shape (sketch)

POST /v1/urls
{ "url": "https://...", "custom_alias": "optional", "ttl_days": 30 }
Idempotency-Key: <uuid>

GET /{code}   -> 302 Location (public)

Tricky parts and solutions

Caveats

• Strong consistency across regions for “latest URL” is expensive; eventual is usually fine for redirects.
• GDPR: logging IPs for analytics needs retention policy and consent where applicable.

Summary

Optimize read path (CDN + Redis + DynamoDB), keep writes safe (idempotency, validation, abuse controls), and treat security as a first-class concern because short links are a social engineering amplifier.