Forem: Umair Shakoor

How I Built Expiring Links With Zero Backend (React + TypeScript Only)

Umair Shakoor — Wed, 29 Apr 2026 02:12:35 +0000

Most "expiring link" tools work the same way: generate a link, store the destination and expiry in a database, check the database on every click, redirect or block accordingly.

That's the obvious approach. It's also the one that requires a backend, a database, server costs, and a breach surface.

I had a constraint: React + TypeScript only, deployed on Vercel, no Node.js, no database, no backend whatsoever.

So I had to find a different way.

The Core Idea: Put Everything in the URL

Instead of storing link data on a server, encode it directly into the URL itself.

When a user creates an expiring link, the app:

Takes the destination URL
Takes the expiry timestamp (Unix ms)
Combines them into a JSON object
Encodes it with btoa() (base64)
Appends it as a URL parameter
Shortens the full URL via TinyURL's API

const payload = {
  url: destinationUrl,
  exp: expiryTimestamp
};

const encoded = btoa(JSON.stringify(payload));
const longUrl = `https://onetimelink.vercel.app/r?d=${encoded}`;

// Then shorten
const shortUrl = await shortenWithTinyURL(longUrl);

When someone visits the short link, TinyURL expands it back to the long URL. The React app decodes the parameter client-side:

const params = new URLSearchParams(window.location.search);
const encoded = params.get('d');

if (!encoded) {
  // Invalid link
  return;
}

try {
  const payload = JSON.parse(atob(encoded));
  const now = Date.now();

  if (now > payload.exp) {
    // Expired — show expiration screen
    setExpired(true);
  } else {
    // Valid — redirect
    window.location.href = payload.url;
  }
} catch {
  // Malformed link
  setInvalid(true);
}

No database query. No server call. No stored data anywhere.

Why This Works

The link carries its own expiry inside itself. The server never needs to know anything. The decision to redirect or block happens entirely in the browser, client-side, on every click.

This has some interesting properties:

Zero storage = zero breach surface. There's no database of sensitive links sitting on a server somewhere. The data exists only in the URL you shared. If the URL is lost, the data is gone.

No server costs. The entire product runs on Vercel's free tier. No compute happens server-side on link visits.

Works offline (partially). If someone has the URL cached, the expiry check still works because it's just a timestamp comparison — no network request needed.

The Tradeoffs

This approach has real limitations worth being honest about.

URL length. Base64-encoding a JSON object adds characters. TinyURL handles the shortening, but the intermediate URL before shortening is long. If TinyURL's API rate limit is hit, the long URL is returned as a fallback — functional but not pretty.

No server-side validation. A determined user could decode the base64, modify the expiry timestamp, re-encode it, and create a "non-expiring" version of the link. For most use cases this doesn't matter — the threat model is casual oversharing, not adversarial attacks. But it's worth knowing.

No analytics. Since nothing is stored server-side, there's no way to know how many times a link was clicked. You get one-directional expiry enforcement, not a dashboard.

Can't revoke early. Once a link is created, it expires when it expires. There's no mechanism to kill it early because there's no server-side record to delete.

What It's Actually Good For

This architecture is a good fit for the specific problem it solves: a freelancer or agency owner sharing something sensitive with a client, once, with a defined window.

Temporary login credentials for a handoff
A staging environment link during a review period
A private document with a natural end date

For these use cases, the limitations above don't matter. The client clicks once, gets what they need, and after the window closes the link is dead.

For anything requiring analytics, multi-click tracking, or early revocation — you need a proper backend. This approach deliberately trades those features for zero storage and zero complexity.

The Stack

React + TypeScript
Vite
Vercel (free tier)
TinyURL API (free tier, no auth required)
btoa() / atob() for encoding — built into every browser, no library needed

Total server infrastructure cost: $0.

Try It

If you're building something where users need to share sensitive links temporarily, the approach above is a legitimate alternative to a full backend for certain use cases.

The live implementation is at onetimelink.vercel.app — free to use, no account needed.

More on the architecture and the product direction on the OneTimeLink blog.

Still building in public. 408 organic users, $0 revenue, first paying customer is the only milestone that matters right now. Follow along if you want the unfiltered version.

I Abandoned My Side Project. 210 Strangers Found It Anyway.

Umair Shakoor — Thu, 23 Apr 2026 04:30:24 +0000

I built a tool in React + TypeScript, got frustrated with it, and moved on to other ideas.

Three months later I opened Google Search Console out of curiosity.

6,700 impressions. 283 clicks. Position 6.5 on Google.

For a project I had completely abandoned.

The backstory

This was my second SaaS attempt. I'd already failed once and was deep in the "just ship something" mindset.

The idea was simple: URL shortener with expiry. When the time runs out, the link dies. No backend. No database. No auth.

I built it, looked at TinyURL and Bitly, thought "these already exist and they're worth $48M, I can't compete" — and moved on.

That was a mistake in reasoning. More on that in a second.

The accidental traction

When I came back to check on it, the keywords ranking were interesting:

"expire link generator"
"temporary link"
"one time use link"
"expiring link"

These aren't brand searches. These are problem-aware searches. People knew they had a problem and were looking for a solution.

I set up GA4. Within 24 hours:

45 users
20% generated a link
72.5% bounce rate (bad, but the intent traffic was real)

The bounce rate told me the landing page was wrong. The usage rate told me the problem was real.

The technical decision that made this possible

Here's the part developers find interesting.

I had a constraint: no backend. I was building in React + TypeScript only, deployed on Vercel. No Node.js, no database, no server.

So how do you build expiring links without storing anything?

Encode everything in the URL itself.

When a user creates a link with an expiry, the app:

Takes the destination URL
Takes the expiry timestamp
Encodes both into a single URL-safe string
Passes that to TinyURL's API to shorten it

When someone visits the link:

The short URL expands to the encoded long URL
The app decodes the destination and expiry from the URL parameters
Checks current timestamp against expiry
If expired: shows expiration screen. If valid: redirects.

No database query. No server call. No stored data. The link carries its own expiry inside itself.

// Simplified encoding logic
const payload = {
  url: destinationUrl,
  exp: expiryTimestamp
};

const encoded = btoa(JSON.stringify(payload));
const longUrl = `https://onetimelink.vercel.app/r?d=${encoded}`;

// Then shorten via TinyURL API
const shortUrl = await shortenWithTinyURL(longUrl);

This has a counterintuitive benefit: zero server storage = zero breach risk. There's nothing to hack. The data lives in the URL and nowhere else.

For freelancers sharing sensitive client links, that's not a technical footnote. That's the entire value proposition.

The validation mistake I almost made

After seeing the traction, my first instinct was to look at Google Drive's sharing features and think "people can already control access there, my expiry idea isn't a moat."

I almost pivoted away from it.

Instead I sent 21 DMs to freelancers, founders, and CTOs asking one question:

"When you send a client a password or sensitive link — what do you actually do?"

Three replies came back:

Djune (Founder & CEO): "I encrypt it in a message with a 1-hour life span with a PIN only they know."

Uzair (Top Rated Freelancer): "I just send them a document with the credentials."

Waqas (CTO): "Yes, this is a real problem. I use 1Password sharing or split the info across two channels. If you're building something: focus on one-time access, expiry, and making it easy for non-technical clients."

That last reply rewrote my entire positioning.

The insight wasn't "expiring links." The insight was "easy for non-technical clients."

Every existing solution — 1Password sharing, encrypted messages, split credentials — requires the recipient to do something. Install an app. Enter a PIN. Have an account.

OneTimeLink requires nothing from the recipient. They click. It works. Or it's expired.

What I changed after validation

Repositioned headline:
Before: "Share URLs that expire automatically"
After: "Share Sensitive Links Your Clients Can Actually Use"

Bounce rate: 72.5% → 51.9% after the copy change alone.

Average engagement: 9s → 19s.

Same product. Different words. Completely different results.

Current state: honest numbers

210 organic users (zero paid traffic)
26 users generated at least one link (12.4% activation)
5 users attempted Pro waitlist signup
Revenue: $0.00
Paying customers: 0

I'm building in public because I think the honest version of this journey is more useful than the highlight reel.

The next milestone is the first paying user. Not the first hundred. Just one person who values this enough to pay $7/month.

What I'd do differently

Set up analytics on day one. I flew blind for months.
Don't confuse "utility" with "demand." Useful ≠ something people will pay for.
Talk to users before building features. Three DM replies taught me more than three months of solo building.
The technical constraint became the product. No backend wasn't a limitation. It became the trust signal: "nothing stored on our servers, ever."

Try it / feedback welcome

If you're a freelancer or developer who shares sensitive stuff with clients, I'd genuinely love brutal feedback:

👉 onetimelink.vercel.app

What would make you actually pay $7/month for this?

Drop it in the comments. I read everything.

Building OneTimeLink in public. Follow along if you want the unfiltered version.

Update — April 29, 2026

A lot has changed since I first published this.

The tool now has proper positioning, a pricing page, a waitlist, and 408 organic users in the last 28 days — still $0 revenue, still building.

I've also started writing about the actual problem: why freelancers share passwords unsafely, what expiring links actually do, and how agencies handle sensitive client deliverables.

If any of that is useful to you, it's all here: onetimelink.vercel.app/blog

The most read so far: The Best Expire Link Generator for Freelancers

Still building in public. Still at $0. First paying customer is the only milestone that matters right now.

Git Commits

Umair Shakoor — Thu, 19 Mar 2026 12:49:58 +0000

I always wonder that how those top engineers write the best commits meanwhile Le me who just commit "update" after doing tons of stuff 😂

until I realized that a commit message should be satisfy :

"If someone reads this commit, will they understand the change WITHOUT opening code?"

That's it .

Congrats, you understand what is good commit message !

but when to commit ?

most people like me after doing random changes commit msg "final changes" , however the real rule is :

"if you can clearly explain what you have changed till now and it is a small change then commit otherwise don't"

Example :

you have added feature of file validation instead of waiting to finish whole project then commit. Just commit on that step with "add file validation"

PS : Hope, this make sense . I learned this the hard way, but you are lucky to know it easily 😁

I got tired of opening 3 different tools just to do simple image edits.

Umair Shakoor — Mon, 09 Mar 2026 10:08:18 +0000

So I built BubbleKit 🫧

A tiny browser tool that lets you:

🖼️ Remove backgrounds
📏 Resize images
⚡ Export WebP fast

Would love honest feedback 🙏

Calculator using Vanilla JavaScript

Umair Shakoor — Thu, 11 Dec 2025 13:29:00 +0000

🚀 What I Practiced

This is a practice project to improve my skills in JS eval and DOM.

💡 Project Overview

Calculator is a great practice project for JS eval and DOM.

✅ Practiced JS eval
✅ Explored amazing array Functions like includes()
✅ Learned JS DOM

🔗 Links

Live Demo
Source Code

PS: Any suggestions or feedback? 🤔

Umair's Coming Soon Portfolio

Umair Shakoor — Tue, 09 Dec 2025 06:53:53 +0000

🚀 What I Practiced

This is a practice project to improve my skills in JavaScript.

💡 Project Overview

You have not seen this kind of Coming Soon Portfolio yet

✅ Practiced JavaScript
✅ Explored Canvas
✅ Learned Ui/Ux

🔗 Links

Live Demo
Source Code

PS: Any suggestions or feedback? 🤔

𝗠𝗼𝘀𝘁 𝘁𝗲𝗮𝗰𝗵𝗲𝗿𝘀 𝗗𝗢𝗡’𝗧 𝗸𝗻𝗼𝘄 𝘁𝗵𝗶𝘀 𝗮𝗯𝗼𝘂𝘁 𝗝𝗮𝘃𝗮𝗦𝗰𝗿𝗶𝗽𝘁'𝘀 finally {} 𝗯𝗹𝗼𝗰𝗸...

Umair Shakoor — Mon, 01 Dec 2025 13:25:40 +0000

try{} and catch{} are easy:

try{} runs code (and prevents script crash on error)
catch{} handles the error

But finally{} 𝗶𝘀 𝘁𝗵𝗲 𝗺𝗶𝘀𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗼𝗼𝗱 𝗼𝗻𝗲.

Most people say:

"finally{} always runs after try{} or catch{}."

Correct… 𝗯𝘂𝘁 𝗼𝗻𝗹𝘆 𝗵𝗮𝗹𝗳 𝘁𝗵𝗲 𝘁𝗿𝘂𝘁𝗵.

Here’s the surprise:

You 𝗱𝗼𝗻’𝘁 𝗻𝗲𝗲𝗱 finally{} to run code after try/catch in a simple block:

try { console.log(a) }
catch (error) { console.log(error) }
finally { console.log("The End") }

You could just place console.log("The End") after everything.

So… what’s the real purpose of finally{}?

𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝗽𝗼𝘄𝗲𝗿 𝗮𝗽𝗽𝗲𝗮𝗿𝘀 𝗶𝗻𝘀𝗶𝗱𝗲 𝗳𝘂𝗻𝗰𝘁𝗶𝗼𝗻𝘀:

function main() {

 try {

 return a

 } catch (error) {

 return error

 } finally {

 console.log("The End")

 }

}

Normally, when a function hits return, the remaining code never executes.

But with finally{}, this line 𝘀𝘁𝗶𝗹𝗹 𝗿𝘂𝗻𝘀, even if both try and catch returned.

That's the true magic of finally{} —

It 𝗮𝗹𝘄𝗮𝘆𝘀 executes, even after a return, making it perfect for cleanup, logs, closing connections, releasing resources, etc.

I was confused about this early on, but once it clicked, it made advanced JS flow much clearer.

𝗣𝗦: Which JavaScript concept confused you the most when you first learned it?

🎉 Mini Game Project Completed: Tic Tac Toe! 🕹️

Umair Shakoor — Mon, 24 Nov 2025 14:42:33 +0000

I'm excited to share that I've completed a Mini Game Project – Tic Tac Toe!

It might sound simple, but small projects like this are essential for building a strong foundation as a Frontend Developer 💻. They prepare you for bigger, more complex projects.

Why I built it

Most web-based Tic Tac Toe games lack a clean, user-friendly UI – so I decided to create one! 🎨

Fun fact: It's a 2-player game, perfect to play with friends 👯

💡 Try it out and share your feedback or suggestions!

Live Preview: us-tictactoe.netlify.app
Source Code: GitHub Repo

No other Icons Library Needed 🥶

Umair Shakoor — Fri, 21 Nov 2025 02:46:49 +0000

Iconify is here.

It is OpenSource All in one Modern Ui Icons library.

They also have a CDN :

<script src="https://code.iconify.design/iconify-icon/3.0.0/iconify-icon.min.js" defer></script>

Just Paste this script in html head tag

Copy Web Components from

🔗 Iconify

by searching for your desired icon.

Then, paste that tag in your body , whereever you wanna use it and Boom 🤯.

Tip :

Use CSS Font-Size to cusomtize the size of the icon and you can also do that by giving width & height to iconify-icon tag.

Have you any suggestions or feedback?
Tell us in comments, I love it.

🫠 Like & Follow us - If you want these kind of more things...

Startup Failure

Umair Shakoor — Sat, 15 Nov 2025 02:46:02 +0000

This Startup Dialo3 Studio failed and the best lessons from mistakes I learned are :

I Entered the Market without proper research and knowledge

If you have enough money to invest in your idea, you can hire top talent and you don't necessarily have good knowledge about the business but for someone who is starting as a Solo Founder with no money could not hire top talent . So, that solo founder, only have option to first gain enough knowledge about that business, its target audience etc then launch. Otherwise, there are very few chances of Success

I was not passionated about that business idea and I just started it for some financial purposes

Any Business to be Successful takes a lot of time. There is always a process of grinding, consistency, patience, hardwork etc. All those could not be carried by a person who just started a business and thinking of it like a shortCut way of earning. Yes, it is true that Business has potential to make you rich but that is not overnight Success.

First Sale is the Hardest Step

When I see that in 1 - 2 months, things are not happening according to my Expectations, I quit. Later, I realize that first sale is the hardest step.
Bcz after that, you know exactly which things works and which not.

Any Suggestions and your Opinions about how a startup is failed mainly due to ... , drop in comments. I love that .

Forget Sensitive URls after Share !

Umair Shakoor — Sun, 09 Nov 2025 09:14:15 +0000

We just launched OneTimeLink on Product Hunt.

OneTimeLink helps you create links that auto-expire for secure, temporary sharing.
If you're curious, feedback and thoughts are welcome.

Website : onetimelink
Product Hunt : onetimelink

Last Post 🥲

Umair Shakoor — Tue, 05 Aug 2025 12:49:38 +0000

🌪️ I used to think…
“If I just shout loud enough online, maybe someone will hear me.”

I posted with ❤️, with 🔥, with truth...
But the world just kept scrolling. 📱

So I’ve decided to stop.
Not because I gave up.
But because I finally understood something deeper:

🤫 Real power is built in silence.

I’m not disappearing.
I’m preparing. 💻🧠

One day — when the world hears a new name shake the ground ⚡
You’ll remember the one who went quiet...

...and returned with thunder. ⚔️⚡🌍

— Umair Shakoor
👣 Building in Silence.
🕶️ See you on the other side...