Jamie Software Lab
All projects Contact
//Projects >_Notes ~About @Contact
All projects Contact
Projects / Link Shortener
Python Flask SQLite JWT Auth

Link Shortener

A URL shortener with full authentication: register, login, create short links, track clicks. JWT tokens, PBKDF2 password hashing, per-IP rate limiting, and a SQLite backend : no external auth libraries.

Try it live How it works Decisions
Status Active
Auth JWT (HS256)
Storage SQLite + WAL
Rate limit 30 req / 60s
Repository →

Live Demo

Register or log in, then shorten URLs. Short links redirect via api.jamieblair.co.uk/s/…

Total links
Total clicks
-
Users
-

What it solves

Clear outcomes, no marketing language.

  • Demonstrates end-to-end authentication: registration, login, token-based sessions.
  • Per-IP rate limiting protects the service from abuse without external tooling.
  • Click tracking gives users analytics on their links.
  • SQLite + WAL mode means zero-config, single-file persistence with concurrent reads.

How it works

From registration to redirect.

Register / Login
PBKDF2-SHA256 password hashing (200k iterations). Server returns a signed JWT valid for 7 days.
Create short link
POST with JWT in Authorization header. Server generates or accepts a custom code, stores in SQLite.
Redirect
GET /s/<code> : server looks up the URL, increments click count, returns a 302 redirect.
Analytics
GET /api/links returns all user's links with click counts. Dashboard updates in real-time.

Decisions

The tradeoffs behind the implementation.

Hand-rolled JWT (no PyJWT)

HS256 signing is three lines of HMAC. Avoids an external dependency while demonstrating that JWT is just base64 + signature : not magic. The secret key is randomised per deploy.

PBKDF2 over bcrypt

PBKDF2 is in Python's standard library (hashlib). No C extensions, no pip install. 200,000 iterations of SHA-256 meets OWASP's current recommendation.

In-memory rate limiting

A simple dict of IP → timestamp list. Resets on restart, which is fine for a demo. Production would use Redis or a middleware like Flask-Limiter.

SQLite with WAL

WAL mode enables concurrent readers with a single writer : perfect for a small service. No database server to manage, backup is just copying one file.

Next steps

Planned improvements, kept realistic.

  • QR code generation for each short link.
  • Click-through analytics with referrer, geo (IP-based), and time series.
  • Custom domains support.
  • Expiration dates and one-time-use links.