Shlink: the self-hosted URL shortener built on PHP, with a REST API, CLI and web client

Bawan — Tue, 27 Oct 2026 18:15:42 +0000

Most link shorteners are hosted services. They are convenient, but your links, your usage limits, and your domain setup depend on someone else's platform. Shlink takes the opposite approach: it is an open source, PHP-based URL shortener that you host yourself and use to serve short links under your own domain.

The repository has about 5.3k stars, 412 forks, and more than 4,800 commits, so it is a mature and actively developed project rather than a weekend experiment.

What is Shlink?

Shlink describes itself as "the definitive self-hosted URL shortener". You deploy it on your own infrastructure, connect your domain, and manage every short link without relying on a third-party service. The code is released under the MIT license.

The project is built on PHP with the Laminas and Mezzio ecosystem, and it is tagged as a REST API project, which tells you a lot about how it is meant to be used: as a service you can integrate into other tools, not only a page with a form.

Two ways to run it

Docker image. There is an official image on Docker Hub. The idea is simple: create a container from the image and pass your configuration through environment variables. This is the quickest route if you already work with containers.

Manual installation. If you prefer a classic setup, you can download a pre-built dist zip from the latest GitHub release (there is one per supported PHP version) or build the project from sources with Composer and the included build.sh script. After that, an interactive installer, shlink-installer, guides you through the configuration.

Requirements for the manual route:

PHP 8.4 or 8.5
PHP extensions: json, curl, pdo, intl, gd, and gmp or bcmath
Optionally apcu (recommended if you do not use RoadRunner), plus sockets and bcmath if you want to integrate with RabbitMQ

Database support

Shlink does not lock you into one database. According to the README, you can use:

MySQL
MariaDB
PostgreSQL
Microsoft SQL Server
SQLite

For anything other than SQLite you create an empty database and let the installer set up the schema. This flexibility means you can start small and move to a heavier database later, or simply reuse whatever your server already runs.

Three ways to interact with it

1. Command line. Shlink ships with a CLI entry point (bin/cli). Every command supports --help, so you can discover what is available directly from the terminal.

2. REST API. The full API is documented on the Shlink website, and there is a separate API Spec portal that works as a sandbox and documents each endpoint. This is what makes Shlink easy to plug into your own applications, scripts, or CI pipelines.

3. Web client. Since most people do not want to call a raw API by hand, the project provides an official web client. You can use the hosted version at app.shlink.io or host the client yourself.

One detail worth knowing: the API and CLI cover mostly the same operations, with one exception. API key management can only be done from the command line, which is a sensible security choice, since a compromised key cannot be used to create more keys.

Other details that stand out

Optional integrations. The README mentions support for RoadRunner as an application server and RabbitMQ integration, which suggests Shlink can scale beyond a simple single-process setup.
GeoLite2 data. The project includes GeoLite2 data from MaxMind, which points to location-aware features for visits.
Engineering quality. The repository has CI, code coverage reporting, a changelog, an upgrade guide, a security policy, and a code of conduct, which is a good sign if you plan to depend on it.
Documentation. The README covers the basics, and the full searchable documentation lives on the project website.

Who is it for?

Shlink is a good fit if you:

want branded short links on your own domain
prefer to own your data instead of depending on a SaaS provider
need an API to create and manage links programmatically
already run servers, containers, or a homelab

It may be more than you need if you only shorten a link once in a while and do not want to maintain any infrastructure.

Final thoughts

Shlink combines the things a self-hosted tool should have: simple Docker deployment, a manual install option, several database choices, a documented REST API, a CLI, and an official web client, all under a permissive MIT license. If you want a link shortener that stays fully under your control, it is well worth a look.

Have you used Shlink or another self-hosted shortener? Share your experience in the comments.

Decoding QR codes on the desktop: what's inside a small open-source Windows scanner

Bawan — Mon, 26 Oct 2026 14:16:10 +0000

Phones read QR codes so well that we forget it's a separate problem when the code is already on your monitor: a 2FA enrollment page, a screenshot in a chat, a code inside a PDF or a design mockup. The usual workaround is to point the phone at your own screen. I wanted to see how a desktop tool handles this, so I looked at Qr Code Scanner for PC, a Windows app published under Apache 2.0. It's a fork of barcodrod.io by Mark Hopper, so most of what follows applies to the original project too.

The stack

The app is built on WinUI 3 and the Windows App SDK, running on .NET 9. Decoding is done by ZXing.Net, the .NET port of the well-known Java ZXing library. Camera input goes through AForge.NET's DirectShow layer. The solution is split into two projects, the UI application and a separate Core project for shared logic, with an installer project and CI workflows next to them. Nothing exotic, which is a good thing: every piece is a mature, documented library.

One decoder, many inputs

The interesting design point is that every input source ends up as the same thing: a bitmap handed to ZXing. Only how the bitmap is obtained changes.

Screen: instead of writing its own capture overlay, the app relies on the Windows Snipping Tool. The user selects a region, the result arrives as an image, and it gets decoded. Reusing the OS tool avoids a whole class of problems around multiple monitors, DPI scaling and overlay windows.

Files and clipboard: an image is loaded or pasted and passed straight to the decoder.

Webcam: frames come in through DirectShow, which is why virtual devices such as OBS Virtual Camera also work. Anything that registers as a DirectShow video source can feed the scanner.

Folder: the same decode call runs in a loop over image files, which is useful for batch jobs such as checking a stack of generated labels.

Symbologies

ZXing gives you 17 formats for free: 2D codes (QR, Data Matrix, PDF417, Aztec) and the common 1D ones (Code 128, EAN, UPC and others). If you've ever had to verify barcodes coming out of a label printer or a ticketing system, being able to decode them from a screenshot without special hardware saves real time.

Generation

The reverse direction uses the same library. The app has templates for Wi-Fi credentials, contacts and email, which are just well-known payload formats inside a QR code: the Wi-Fi one, for example, is a string with SSID, auth type and password fields that phone cameras know how to parse. You can also pick colors and the error-correction level. Higher correction makes the code denser but lets it survive damage or a logo placed in the middle.

Privacy decisions

Three choices here are worth copying in any tool that handles QR codes. All decoding is local, and the app works offline with no telemetry. Decoded URLs are shown to the user before anything opens, which matters because a QR code is an unreadable link, and auto-opening it is exactly what "quishing" (QR phishing) relies on. Scan history can be exported or switched off entirely, since decoded payloads often contain Wi-Fi passwords or one-time secrets.

Limitations

It's Windows-only (10 and 11, x64), and the screen mode depends on the Snipping Tool being available. The download is a fairly large zip, around 74 MB, mostly because of the bundled Windows App SDK and .NET runtime rather than the app's own code.

Takeaway

If you're building something similar, the architecture is a useful pattern: normalize every input into a bitmap, keep one decoding path, reuse OS facilities for capture instead of reinventing them, and treat decoded content as untrusted input. The code is small enough to read in an evening.

DEV Community: Bawan