Technical interview guide

URL Shortener Design

Designing a URL shortener: unique keys, redirect semantics, cache TTLs, click accounting off the GET path, and open-redirect abuse.

Read: 38 min
Practice MCQs: 25
Interview QA: 25
Edition: v4
Editorial status: Reviewed
Relevant for: Agentic AI EngineerBackend EngineerBlockchain DeveloperCloud ArchitectCybersecurity EngineerData ArchitectData EngineerDevOps EngineerForward Deployed Engineer (FDE)Full-Stack DeveloperIdentity and Access Management (IAM) EngineerMachine Learning EngineerPlatform EngineerSecurity ArchitectSite Reliability EngineerSoftware EngineerSolutions ArchitectTechnical Product Manager

Scope: HTTP per RFC 9110 and RFC 6585; UUIDs per RFC 9562; uniqueness illustrated with PostgreSQL unique indexes and Redis GET; abuse controls per OWASP and Unicode TR36.

Interview QA

Treat each question like a live interview question: answer out loud first (structure, assumptions, tradeoffs), then open the model answer to spot gaps and rehearse a tighter follow-up.

Curated: 2026-10-05 · Written: 2026-10-05 · Reviewed: 2026-10-04

QA-1

Explain the mapping, not the hash and how it changes a production decision.

QA-2

How would you reason about base62 encoding of a counter in a system you own?

QA-3

How do you decouple real-time click tracking and analytics from the critical redirect read path to prevent latency degradation?

QA-4

What does collision handling on insert guarantee, and what does it deliberately leave open?

QA-5

Describe custom aliases and the evidence you would collect before relying on it.

QA-6

A teammate proposes a design that hinges on 301 versus 302 versus 307. How do you evaluate it?

QA-7

Where does open redirects matter, and where is it irrelevant?

QA-8

Teach the read path latency budget to an engineer who has only seen it as a rule of thumb.

QA-9

How do you design URL expiration and cleanup at scale without degrading redirect read latencies or overloading the database?

QA-10

How would you test a claim that the system depends on negative caching?

QA-11

What would you measure before treating idempotent create as settled?

QA-12

How does read-your-writes after create change if the workload grows by two orders of magnitude?

QA-13

How do you integrate asynchronous malware scanning and URL reputation checks without introducing high write latency during URL shortening?

QA-14

When would you refuse a design because of capacity of the write path?

QA-15

How would you explain partitioning the map without using the usual slogan?

QA-16

What failure would you inject to check a team's understanding of preview and interstitial?

QA-17

How should on-call treat an alert that names malware scanning as the cause?

QA-18

What belongs in a runbook section on rate limits on minting, and what does not?

QA-19

What trade-off does key alphabet and copy-paste force that a junior answer usually skips?

QA-20

How would you review a pull request whose risk is hTTPS and mixed destinations?

QA-21

How would you brief product on why analytics privacy delays a ship date?

QA-22

What is the smallest experiment that would change your mind about cDN in front of 302?

QA-23

How does multi-region active-active interact with rollback, and where do people ignore that?

QA-24

What would you ask a candidate who recites what to draw first in the interview but cannot apply it?

QA-25