Are Google Shortened URLs (goo.gl) Publicized, Sequential, or Secret?

Google has a shortening service at http://goo.gl/ which let's you convert a long URL to a short one. It says the following about the URLs it generates:

All goo.gl URLs and click analytics are public and can be accessed by anyone.

I understand that the URLs are not private. However, the above does not specify the difference between a publicized, sequential, or secret URL. Below I will define what I mean by each of these terms. Notice how their definitions make them mutually exclusive. Which of these, then, best describes what goo.gl uses?

Say I use goo.gl and get the URL http://goo.gl/abc57.

Publicizing:
If Google has a page such as http://goo.gl/list-all which has all of the URLs that have been generated, then I would consider that to be publicizing the URL. Or if there were a page that listed URLs by category, or by number of visits, etc. that would also be considered publicizing the URL. If Google has an API that lets people access this information, then I would also consider that publicizing the URL.

Sequential:
If Google distributes URLs in a sequential manner, then it is really easy to get a list such as the publicized version above. For example, if someone got the URL http://goo.gl/abc58, they could enter in the previous URL, http://goo.gl/abc57, and easily see the link I just generated. If it is both sequential and publicized, publicized would trump this definition, since it's much easier to use the publicized page than randomly looking through a sequence.

Secret:
The URLs Google generates are random enough to not be sequential (i.e. so it's not easy to guess them), and they are not publicized anywhere. Therefore, while it is possible that someone could access the link I just generated, it's not probable since it would involve pure chance. In other words, I can assume that when I generate a goo.gl URL no one will know about it unless the URL is specifically shared with them.

Private:
These would be links that can only be accessed by people you intend to share the URL with. (E.g. it may require a login and password). Google's service is obviously not a private one, since it states that above.

Notes:

• There is a page that lists all of your generated URLs. If you are the only one that can view this page, that would not necessarily mean that the service is publicized. If there is any way for someone else to view these details (e.g. via an API), that means that the service is publicized; unless it is very difficult to view this page (e.g. they need a secret ID associated with your account which they can't easily get unless you give it to them).
• Additionally, if you know someone else's Google ID, can you list their shortened URLs ? – MikeW Oct 5 '16 at 10:26

Publicizing

While not 'true' publicized - you can goto Goo.gl and view a list of all links that you've shortened - provided you were logged in to your Google account.

Sequential

It's very hard to answer this - I did a short experiment where I ,posted 4 links back to back and the shortener generated seemingly random links.

Having said that, if you decrement/replace the letter, you will go to a previous shortened URL, if it has been assigned.

Secret

They aren't - as mentioned above, you can replace any letter(s) and still find out the analytics.

Plus it's explicitly mentioned in the URL shortener page:

All goo.gl URLs and click analytics are public and can be accessed by anyone.

Private

For reasons mentioned above, it's not private

• For the publicizing section, add the API details too. :) It works on any URL. Be it yours or mine. – Bibhas May 13 '12 at 17:45
• The way I defined the 4 states, they should be mutually exclusive. So it should be exactly one of them. I would not consider the tip about going into your own account to see the list you created as being publicized because only you can see that page, right? From your example, it seems that it is not sequential. So that only leaves "secret" or "publicized". I know that you can replace the letter in a URL and arrive at the link, but I would still consider that secret. I mentioned that with a secret URL there still is a chance that someone will land on it, but it's unlikely. – Senseful May 13 '12 at 17:45
• @Senseful hence my mention - while not 'true' publicized I don't know why you'd call it a service a secret when it's creators explicitly mention it's not. – Sathyajith Bhat May 13 '12 at 17:52

While @Sathya reasoned for all 4 states, I'd call it Publicizing. Reasons -

If Google has a page such as http://goo.gl/list-all which has all of the URLs that have been generated, then I would consider that to be publicizing the URL.

Generate a list of all possible alpha-numeric combination of ~5 digits. That'd be a list of all possibly generated short urls. While some would return 404(Not used yet, but will be used soon), others would work.

Or if there were a page that listed URLs by category, or by number of visits, etc. that would also be considered publicizing the URL.

Same as above, you can access details of any shortened url by following the url with a +. E.g. http://goo.gl/0Iis7+ . Once you get a list and their details, you can categorize or sort them. Google won't provide that.

If Google has an API that lets people access this information, then I would also consider that publicizing the URL.

Here is your API. Shorten or Expand any URL you want. Be it yours or mine.

• I think that makes the generation of a complete list of working URLs infeasible, at least using the API. – törzsmókus Jan 15 '15 at 10:06
• Assuming the length of the slug is 5, you can generate the complete list of urls using any programming language. Then just make GET requests to all of them and get the status code and you'll have a list of all working urls at that point of time. You don have to touch the API. – Bibhas Jan 17 '15 at 6:43
• Although possible in theory, visiting a list all possible permutations (6 characters at a time) of 26 lower case + 26 upper case + 10 digits is practically impossible... P(62,6) = 44,261,653,680. The number is probably even higher because of the short URL's using 5 characters, etc. – Kamal Oct 16 '18 at 12:36

I am still looking into this but I am beginning to suspect that there is no http://goo.gl/list-all link or similar capability. (I didn't find one, but obviously that's no proof). It's possible that the warning is there merely because the name space is relatively small, so typing a random shortener has a good probability of getting you somewhere, and one can easily write a crawler which could collect a lot of them and publish them and Google could not do anything about it.

Within a few seconds of creating a shortened URL, Google tells me that the link has been visited by a couple of machines and browsers other than my own. This indicates that someone is crawling all of the shortened URLs, presumably via the methods described above.