What happens in the second after you type a web address

Typing an address and pressing Enter feels instant. Underneath, several systems built over decades work together in a fixed order. Each was designed separately, often years apart, yet they fit together closely enough that most people never need to think about them.

0. Before anything leaves your computer

The browser first works out what you typed. If it does not look like an address, it is sent to your search engine instead. If it is an address, the browser checks whether it already has a recent copy of the page, or of any of the lookups below, saved in its cache. Anything it can reuse saves time.

1. Finding the address: DNS

Computers on the internet find each other by numeric IP addresses, not names. The Domain Name System works like a phone book. Your device asks a DNS resolver, usually run by your internet provider or a public service, which IP address belongs to the name you typed. Answers are cached, so popular sites are found almost instantly.

If the resolver does not know the answer, it works through a hierarchy. It asks a root server where to find the servers for the ending, such as “.com”. Those servers point it to the servers responsible for the specific domain, which finally give the address. DNS was introduced in the early 1980s to replace a single shared list of names that had become too big to manage by hand.

2. Opening a connection

With the IP address in hand, your browser opens a connection to the server. Traditionally this uses TCP, which makes sure data arrives complete and in order. Newer versions of HTTP can run over QUIC, a protocol built on UDP that sets up connections faster.

Under TCP, the two machines exchange a short series of messages before any real data flows, a step often called the handshake. Each exchange is a round trip across the network, which is why reducing the number of round trips has been a goal of almost every recent improvement.

3. Agreeing on encryption: TLS

Next comes the TLS handshake. The server proves its identity with a certificate signed by a trusted certificate authority, and the two sides agree on keys to encrypt everything that follows. This is what the padlock icon and the “https” in the address mean.

Your browser and operating system ship with a list of certificate authorities they trust. If the server’s certificate is out of date, issued for a different name or signed by an unknown authority, the browser shows a warning. The latest version of the protocol, TLS 1.3, was published in 2018 and cut the number of round trips needed to set up a secure connection.

4. Asking for the page: HTTP

Now your browser sends an HTTP request: in effect, “please send me the page at this address”. The server replies with a status code (200 means OK, 404 means not found) and the page’s HTML.

HTTP was created at CERN alongside the first web browser at the start of the 1990s. Early versions sent one request at a time. HTTP/2, standardised in 2015, lets a browser send many requests over a single connection at once, and HTTP/3, which runs over QUIC, followed in 2022.

Other status codes you may meet include:

• 301 or 302: the page has moved, and the browser is redirected elsewhere.
• 403: the server understood the request but refuses to provide the page.
• 500: something went wrong on the server itself.
• 503: the service is temporarily unavailable, often because it is overloaded.

5. Building what you see

The HTML refers to other files: stylesheets, scripts, images and fonts. Your browser requests those too, often many at once, then lays out the page and draws it on screen.

The browser turns the HTML into a structure in memory, applies the styles to work out where everything goes, runs scripts that may change the page, and then paints pixels to the screen. Good sites show useful content before every file has arrived, so the page feels quick even while it is still loading.

Common misconceptions

• The padlock is not a seal of approval. It shows that your connection is encrypted and that the certificate matches the address. A scam site can have a padlock too.
• Private browsing is not invisible browsing. It stops your browser keeping history on your device, but websites, your employer’s network and your internet provider can still see traffic.
• DNS lookups were traditionally unencrypted. Many browsers now support encrypted DNS, which makes it harder for others on the network to see which sites you look up.

Why sites feel slow, sometimes

Every step adds a little time, and distance matters: data travelling between continents takes longer. That is why large sites use content delivery networks, which keep copies of files on servers close to readers.

Other common causes are heavy images, many third-party scripts such as adverts and trackers, and slow mobile connections. If one site is slow and others are fine, the problem is probably at that site’s end. If everything is slow, check your own connection first.

What it means for you

You do not need to memorise any of this, but two habits follow from it. Check the address bar, not just the padlock, before typing anything sensitive. And if a page will not load, the error message usually tells you which step failed: a DNS error means the name could not be found, while a certificate warning means the secure connection could not be confirmed.