1Protecting your account
We store account passwords only as Argon2id hashes, a modern one-way method. Nobody at hi4.in can see your password.
New passwords need at least 8 characters with upper- and lower-case letters, a number and a symbol.
Repeated failed log-ins from the same IP address or for the same email are blocked for 15 minutes, and addresses that keep trying are blocked for longer.
Log-in and sign-up use Google reCAPTCHA, and sign-ups are screened for automated patterns.
Passwords on password-protected links are also stored only as hashes.
2Protecting the website
- HTTPS everywhere: every page and every short link is served over an encrypted connection. Plain http:// requests are redirected to https://, and browsers are told to use HTTPS only (HSTS).
- Forms are protected against cross-site request forgery (CSRF) with secret tokens.
- Rate limits on link creation, forms, sign-ups and log-ins stop bots and abuse.
- Our new website sends a Content Security Policy and blocks other sites from framing our pages.
3Protecting people who click
- New links made with our website tools are checked for scam signs — look-alike bank, UPI and government addresses, risky domain endings, bare IP addresses and common scam words — and links that look dangerous are refused.
- Anyone can add + to the end of a hi4.in link to see where it goes, with a safety check, before opening it.
- Anyone can Report a link a hi4.in link. A person reviews every report.
- Open-in-app links only work for a fixed list of known apps, so they cannot be used to redirect people to arbitrary websites.
- We never put ads, pop-ups or tracking scripts on your short links.
Our safety checks reduce risk but cannot catch every harmful website. Never share an OTP, UPI PIN or password because of a link. Read our Acceptable use policy.
4What you can do
- Use a long, unique password for hi4.in, ideally from a password manager.
- Keep API keys secret. Delete keys you no longer use.
- Use password protection and expiry dates for links that should not stay public.
- Log out on shared or public computers.
- hi4.in staff will never ask for your password or an OTP.
5Report a security issue
Found a security problem in hi4.in? Please email support@hi4.in with "Security" in the subject. Tell us what you found, the steps to reproduce it, and the impact you expect.
While you investigate, please:
- only use accounts and data that belong to you;
- not access, change or delete other people's data, and stop as soon as you see any;
- not run denial-of-service tests, spam or social-engineering attacks on our users or staff;
- give us reasonable time to fix the problem before you tell anyone else.
We will reply, keep you updated while we fix it, and, if you like, thank you publicly once it is fixed. We do not run a paid bug bounty programme yet.