In more detail
The service stores a short code mapped to the long address and answers each visit with a Redirect, usually 301 or 302. With 62 possible characters (a–z, A–Z, 0–9), seven-character codes give 62^7 = 3,521,614,606,208 combinations, about 3.5 trillion. Many services count clicks, and some show an interstitial page or add tracking before sending you on.
Why it matters
They hide the destination, so attackers use them to disguise Phishing. Expanding a short link, which follows the redirect without opening the page, shows where it really leads before you click. If the shortening service shuts down or deletes the code, every link that uses it dies, so avoid them in documents meant to last.
Example
A request for only the headers of a short link returns the redirect and nothing else:
HEAD /x7Kq2Pb HTTP/1.1
Host: s.example
HTTP/1.1 301 Moved Permanently
Location: https://example.com/guides/dns/?utm_source=newsletter
The Location header is the real destination; the Short URL Expander reads it for you, following any further redirects.