The URL shortener is one of the internet's oldest conveniences, and one of its most neglected. The tools that survived tend to be either enterprise suites priced for procurement departments or free services with a quiet sideline in visitor data. InBio, which opens to everyone today, is a bet that the category deserves better: links that are fast, numbers that are honest, and a free tier that is actually useful.
This is the short version of what we built and why. If you would rather just try it, the URL shortener takes about four seconds and needs no account.
What you get
Paste a long URL and you get a short one, served from an in-memory cache in a few milliseconds. The more interesting machinery sits behind it.
Every link carries a QR code you can style — dotted patterns, rounded markers, custom colors — and every design is machine-verified to stay scannable. Because the code encodes the short link rather than the destination, you can change where it points long after it has been printed. A menu that moves no longer costs you a print run. Making a batch for a campaign? The bulk shortener does up to 50 at once, and the UTM builder tags them consistently for reporting.
The analytics make one unusual promise: they exclude the machines. A remarkable share of clicks on any shared link comes from preview crawlers, email security scanners, and monitoring bots, and most tools happily count them as engagement. InBio tallies bots separately and shows you both numbers — the reasoning is in our piece on bot traffic and click analytics. What remains — clicks by country, device, browser, and referrer — describes actual people.
The free plan covers 50 links and 5,000 tracked clicks a month, custom slugs and QR codes included; paid tiers add custom domains, longer history, and higher limits (see pricing). One rule applies to all of them: existing links keep redirecting even after you hit a limit. A link, once shared, is infrastructure, and infrastructure should not go dark over billing. The full lineup of free tools lives at in.bio/tools.
How click analytics without IP addresses works
The privacy claim is easy to state and worth explaining, because an unexplained claim reads as marketing and an explained one reads as engineering.
InBio never stores a visitor's raw IP address. When a click arrives, we derive what we need in the moment — a country and city from the IP, a device and browser from the user agent — and then discard the address itself. To estimate unique visitors without keeping anyone's identity, we use a one-way hash whose key rotates every day, so the same person clicking today and tomorrow cannot be recognised as the same person by anyone, including us.
That design has an honest cost, and we would rather name it than hide it: because we do not fingerprint, we cannot tell two people on the same office network apart, and our unique-visitor number is an estimate rather than a headcount. We think that is the right trade — a slightly fuzzier unique count in exchange for never holding data that could identify your visitors. Do Not Track is honored, and the privacy policy is short because there is little to confess.
What this means under GDPR
This is not legal advice, but the shape of it is simple: the less personal data you collect, the lighter your obligations. An IP address is personal data under GDPR, so a tool that never stores one removes an entire category of risk from your reporting.
That matters most somewhere unexpected — printed QR codes. A code on a poster or a pack lives in a physical space where you cannot show a consent banner before someone points a camera at it. If scanning that code fed a tracker that stored the visitor's IP, you would have a genuine problem. Because a tracked scan here stores no such thing, the printed code stays simple to run. Privacy and printed media turn out to be the same conversation.
The keyless API, and why
Two endpoints work without any signup at all. One request shortens a URL:
curl -X POST https://in.bio/api/shorten \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'And a single URL is itself a styled QR code image: https://in.bio/api/qr?url=https://example.com&dot_style=dots. No key, no account, no OAuth dance.
The reasoning is friction. Most shorten-a-link jobs are one-offs — a script, a webhook, an agent doing a task — and making each one register for a key first is exactly the tax that keeps people gluing brittle scrapers together instead. Removing the key is what makes InBio usable in a single line. What keeps that viable is the abuse control behind it: every destination is screened for phishing and malware, requests are rate-limited per IP, and abusive links are caught and removed, so the keyless surface cannot be farmed. For anything more ambitious there are official SDKs in five languages with zero dependencies, and the full reference lives at docs.in.bio.
The MCP server
Software is acquiring a new class of user — AI agents — and InBio was built expecting them. MCP, the Model Context Protocol, is the emerging standard for letting an assistant like Claude call external tools; a hosted MCP server at mcp.in.bio/mcp, listed in the official registry, exposes InBio to any MCP client.
The keyless tools — shorten_link and generate_qr_code — need no credentials at all, so an agent can shorten a URL or make a QR code mid-task. Connect an account and it can manage links, folders, and analytics too. Concretely: you can ask an assistant to "shorten these forty campaign URLs, tag them for our newsletter, and give me the QR codes," and it will, because the tools are right there. An OpenAPI spec, an llms.txt, and an agent-skills index round out the paperwork; the MCP reference is at docs.in.bio.
What we deliberately didn't build
What a tool refuses to build says as much as its feature list. InBio has no retargeting pixels, no visitor fingerprinting, and no arrangement anywhere that resells or brokers the data your links generate. We do not build a shadow profile of the people who click your links, because the entire analytics design is arranged so that we could not, even if a future us wanted to.
That is the one line no shortener that monetises visitor data can copy without rebuilding its business, and it is the reason the privacy claim leads this post rather than closing it. If you want the measured evidence that fast and honest are not mutually exclusive, we benchmarked ourselves against seven competitors in the best URL shortener test — including the places we lose.
The best way to judge a link tool is to use it, and that takes about four seconds: paste something into the shortener. If you find a sharp edge, hello@in.bio reaches a human.