What are the parts of a URL?

URL terminology: a practical guide

It's usually fine to say "I bought a domain" or "our images are on another site," even if that's not strictly accurate. But in some contexts — working with cookies, for instance — you need to be precise about the difference between a site and an origin. URL terminology is formalized in the URL standard, which also defines a JavaScript API for accessing URL components. This article covers terms commonly used with HTTP and HTTPS URL strings; it does not address file or data URLs.

You can use the URL API to examine the parts of any URL string. The example below shows how to retrieve a few of these values programmatically:

let url = new URL('https://foo.com.au:1234/bar/foo.html#bar');
console.log(url);

Anatomy of a URL string

The components of a URL are named alphabetically below. For reference, the URL standard provides precise definitions of several of these terms, and an interactive analyzer can help visualize how a parsed URL breaks down into parts.

At the broadest level, a URL splits into the scheme (the part before ://, which names the network protocol to use), the host (domain name or IP address), the port (if specified), the pathname, an optional search (or query) string and an optional hash (or fragment).

Scheme and protocol

The scheme defines the network protocol requested for the URL — for example, an https scheme means the request should be made over HTTPS. When the scheme is something that isn't a network protocol, such as file, mailto or git, behavior depends on the user agent; for instance, most browsers open the default email application for mailto links. The URL API exposes protocol (the scheme followed by :, like http:) but not scheme itself.

Host, hostname and port

A host, per the URL standard, can be a domain name, an IPv4 address, an IPv6 address, an opaque host, or an empty host. The standard's definition of host does not include the port. The API's URL.host does include the port (unless it's the default for the scheme), while URL.hostname never does.

A hostname is a term defined by the JavaScript URL API rather than the URL standard itself. It simply refers to the host without the port.

Non-default port numbers are expressed after a colon — https://example.com:1234/tabby — and must be a 16-bit unsigned integer (0–65535). HTTP defaults to port 80 and HTTPS to 443. The API returns an empty string for a default port.

Domain-related terms

The domain name is everything between the scheme and the path or port, separated into labels by dots.

Top-level domains include country-code TLDs (ccTLDs), such as au in example.org.au or io in example.io. The effective top-level domain (eTLD), from the Public Suffix List, extends the notion of TLD to multi-part registrable suffixes: com, com.au, github.io, sa.edu.au and schools.nsw.edu.au are all examples. Chromium and Firefox shipe embedded copies of this list.

The registrable domain (also known as eTLD+1) is the eTLD plus the label immediately before it: example.com, example.org.au, example.github.io, example.schools.nsw.edu.au, and so on. A fully-qualified domain name (FQDN) is a complete address for a server that maps to an IP address.

Path, filename, search and fragment

The pathname is the part of an HTTP(S) URL after the domain and port (if present), including any filename, but excluding the search string and hash. The path is sometimes used informally to mean the pathname minus the filename: for https://example.com/cat/pattern/tabby.html, the "path" would be /cat/pattern.

The filename is not formally defined by the URL standard nor part of the URL API, but the term is common shorthand for the final segment of a path on the assumption — often wrong — that the URL maps to a real directory structure. In https://example.com/dir/file.html, file.html is the filename. Browsers also use such a value to name downloaded assets; https://example.com/images/image.jpg would typically be saved locally as image.jpg.

The search is a question mark followed by key-value pairs representing parameters.

The hash (also called an anchor) is a #-terminated string that holds a fragment identifier — in https://example.com/cats#tabby, the hash value is #tabby. The text after the #, minus the # itself, is the fragment. The API returns the hash rather than the fragment. It's also possible to link to and highlight a text fragment.

There is no standard term for a URL's username or password (see the URL standard's definitions and API properties), though these appear in URLs for authentication.

Origin is one more important conceptual grouping: for HTTP(S) URLs, it's the scheme, host and port (unless the port is the default). The URL standard provides a formal definition and links to the HTML standard for background.

Query parameters and domain hierarchy

Search parameters, also called query parameters, are the individual key-value pairs carried in a URL's search string. In https://example.com/cats?pattern=tabby&mood=bonkers, the search string contains two parameters: pattern=tabby and mood=bonkers.

The labels in a URL's hostname form a hierarchy. The top-level domain (TLD) is the label after the final dot, listed in IANA's Root Zone Database — for example, org, com, or the country-code domains uk and tv. The label immediately before the TLD is the second-level domain. In https://www.example.com, the second-level domain is example, making the whole registrable domain example.com.

This hierarchy becomes clearer with multipart public suffixes. For https://example.org.au, the TLD is au, the second-level domain is org, and the third-level domain is example. Here org.au is a two-part effective top-level domain (eTLD), and example.org.au is a subdomain of it.

Subdomains are any domain labels within a higher-level domain. For single-part TLDs, each dot-separated part before the TLD is a subdomain: www.example.com is a subdomain of example.com, and support.api.example.org is a subdomain of api.example.org, which is itself a subdomain of example.org. For two-part eTLDs from the Public Suffix List, such as co.uk or github.io, subdomains are the labels before that eTLD — so cat.example.co.uk is a subdomain of example.co.uk.

Site versus origin

The HTML standard defines "site," a concept distinct from origin, along with related terms like same-site and schemeless same-site. It is not defined by the URL standard or the JavaScript URL API. The site concept includes the scheme but, unlike origin, excludes port.

For an HTTP or HTTPS URL with a single-part eTLD such as https://example.com, the site is the scheme plus the eTLD and the label immediately before it. Given https://www.example.com/cat, the site is https://example.com. For multipart eTLDs like co.uk or sa.edu.au, the same rule applies: https://cat.example.co.uk/tabby has the site https://example.co.uk, and https://www.education.sa.gov.au has the site https://education.sa.gov.au.

Text fragments

A text fragment is a special type of fragment that lets a URL point to a specific range of text in a page. When the link is followed, the browser locates, scrolls to, and highlights that text. A text fragment begins with :~:text= followed by the search term. For instance, https://web.dev/articles/url-parts#:~:text=fragment targets the first occurrence of "fragment" on that page.

Deprecated credentials in URLs

URLs can include an optional username and password at the start, as in https://user123:[email protected] where the username is user123. This practice is deprecated for security reasons and is often ignored: the credentials are transmitted in plain text. If the username contains a colon (:) or at sign (@), those characters must be percent-encoded as %3A and %40 respectively.

TLDs versus eTLDs

Not every TLD is a single label from the browser's perspective of registrable domains. The Public Suffix List catalogs eTLDs, which can span one, two, or more labels. A TLD can also be an eTLD, as with com in https://example.com. The distinction matters when computing sites, origins, and cookie scoping for domains such as co.uk or sa.edu.au, where the effective public suffix has multiple parts.