What Is a URL

A URL (Uniform Resource Locator) is a string that indicates the location of a resource on the internet. Just as a street address points to a building, a URL points to content on the web.

The string displayed in your browser's address bar, such as https://www.example.com/page, is a URL. Every time you click a link, your browser uses this URL to access the server.

URL Structure

A URL consists of several parts.

The https:// part. Specifies the communication method. https means encrypted, http means unencrypted.

The www.example.com part. The name of the website. Translated to an IP address by DNS.

The /page part. Specifies which page on the server to display.

URLs may also include query parameters (?q=search) for passing search conditions and fragments (#section1) for pointing to specific positions within a page.

How to Read URLs Safely

To spot phishing, the most important skill is reading the domain name correctly. The key is to check the part between :// and the next /.

Legitimate: https://www.amazon.co.jp/dp/... - domain is amazon.co.jp
Fake: https://amazon.co.jp.evil.com/... - domain is evil.com

Read the host from right to left. The part someone actually registered is the top-level domain (.com, .jp) plus one label to its left; when the suffix has two parts, such as co.jp or co.uk, include one more label (amazon in amazon.co.jp). Where the suffix ends depends on each registry's policy, so browsers rely on the Public Suffix List to draw that line. Everything further left is a subdomain that the owner can add at will.

Also, when an @ appears between :// and the next /, the host is whatever follows that @; the left side is a field for credentials. That trick is used to dress up a link, so if you see an @ in that position, read the right-hand side. An @ later in the URL, inside the path, is just an ordinary character (as in social-media profile URLs) and this rule does not apply.

Shortened URL Risks

Shortened URLs like bit.ly/xxxxx or t.co/xxxxx hide the original URL, making it impossible to judge whether the redirect destination is safe.

How to safely check shortened URLs:

Use a URL expander service to check the destination before clicking
Only click links from trusted senders

URLs and Privacy

URLs can contain privacy-related information. Tracking parameters (?utm_source=...) are used to track where you came from. When copying and sharing URLs, removing unnecessary parameters helps protect your privacy.

For more details on this topic, see also How to Read URLs Safely.

Common Misconceptions

HTTPS means the site is safe: HTTPS only indicates that the communication is encrypted. It does not guarantee the trustworthiness of the site. Scam sites can also obtain free SSL certificates.
Longer URLs are more suspicious: There is no correlation between URL length and safety. Legitimate sites often have very long URLs for product pages. What matters is checking the domain name.

URL vs URI

URL

Indicates the location of a resource. Used as a web address in everyday life.

URI

A broader concept indicating a resource identifier. URL is a type of URI. URI is the formal term in technical specifications.

URL