5157

What is the maximum length of a URL in different browsers? Does it differ among browsers?

Is a maximum URL length part of the HTTP specification?

Zach Smith
  • 6,866
  • 8
  • 42
  • 92
Sander Versluys
  • 67,197
  • 23
  • 79
  • 89
  • 43
    FWIW, for Windows users, server paths exceeding 250 characters _may_ cause grief when building URLs, for example, see [HttpContext.Current.Server.MapPath fails for long file names](http://forums.asp.net/t/1829786.aspx/1?HttpContext+Current+Server+MapPath+fails+for+long+file+names) at **forums.asp.net**. bottom line: if one restriction does not get you, another one _may_. – gerryLowry Aug 02 '12 at 20:32
  • @gerryLowry: Windows tools already tend to have problems even compiling with long file names, so this usually isn't a concern if you only use `MapPath` for actual file names. One hopes that the extra-long url names are not paired with extra-long file paths, since the latter results in an unusable mess whereas the former may just be a developer abusing get requests where he should be using post requests. – Brian Feb 18 '13 at 12:41
  • 23
    From http://support.microsoft.com/kb/208427 "Maximum URL length is **2,083** characters in Internet Explorer" – gavenkoa Feb 27 '13 at 13:17
  • 12
    May I ask _why_ did you need to know that? I.e. what's the use-case for having a long URL? – o0'. Apr 08 '13 at 12:47
  • 1
    Related ServerFault question about Tomcat: http://serverfault.com/questions/56691/whats-the-maximum-url-length-in-tomcat – Raedwald Sep 12 '13 at 11:32
  • Related ServerFault question about Jetty: http://serverfault.com/questions/136249/how-do-we-increase-the-maximum-allowed-http-get-query-length-in-jetty – Raedwald Sep 12 '13 at 11:33
  • 20
    @Lohoris: If a form uses `get` rather than `post`, then bookmarking the page reached by the filled-in form will capture the information that was entered. In some cases, that can be bad, but in other cases it can be useful. For that to work, however, the browser has to be able to handle a URL containing all the information. – supercat Dec 10 '13 at 22:03
  • 4
    @Lohoris When we write pages to generate reports we used a criteria form. It is useful on some reports to be able to email the url to someone with the criteria built in. Depending on the report we are at times forced to use `post` or the criteria gets truncated. Just another use case. – buzzsawddog Feb 06 '14 at 16:32
  • 1
    If your input needs to be in URL parameters, then you might want this as long as possible. Tableau allows you to embed webpages into dashboards, and make the URL dynamic based on what the user clicks on. I might want to pass a 100's of pages of text as a URL param to do some sentiment analysis and then return a result. These 100's of pages of text would change depending on which book the user clicks on. – ThomasRones Sep 29 '17 at 15:28
  • @o0'. Parameters. Especially user-defined ones. – Jacob Ford Sep 14 '19 at 05:13
  • @o0'.A good example of a long URL is when I'm asking Clickatell to send a message. I have to include the message itself in URL format (e.g. space is %20) as well as the other parameters. – Philip Kearns Mar 06 '20 at 09:41

19 Answers19

5332

Short answer - de facto limit of 2000 characters

If you keep URLs under 2000 characters, they'll work in virtually any combination of client and server software.

If you are targeting particular browsers, see below for more details on specific limits.

Longer answer - first, the standards...

RFC 2616 (Hypertext Transfer Protocol HTTP/1.1) section 3.2.1 says

The HTTP protocol does not place any a priori limit on the length of a URI. Servers MUST be able to handle the URI of any resource they serve, and SHOULD be able to handle URIs of unbounded length if they provide GET-based forms that could generate such URIs. A server SHOULD return 414 (Request-URI Too Long) status if a URI is longer than the server can handle (see section 10.4.15).

That RFC has been obsoleted by RFC7230 which is a refresh of the HTTP/1.1 specification. It contains similar language, but also goes on to suggest this:

Various ad hoc limitations on request-line length are found in practice. It is RECOMMENDED that all HTTP senders and recipients support, at a minimum, request-line lengths of 8000 octets.

...and the reality

That's what the standards say. For the reality, there was an article on boutell.com (link goes to Internet Archive backup) that discussed what individual browser and server implementations will support. The executive summary is:

Extremely long URLs are usually a mistake. URLs over 2,000 characters will not work in the most popular web browsers. Don't use them if you intend your site to work for the majority of Internet users.

(Note: this is a quote from an article written in 2006, but in 2015 IE's declining usage means that longer URLs do work for the majority. However, IE still has the limitation...)

Internet Explorer's limitations...

IE8's maximum URL length is 2083 chars, and it seems IE9 has a similar limit.

I've tested IE10 and the address bar will only accept 2083 chars. You can click a URL which is longer than this, but the address bar will still only show 2083 characters of this link.

There's a nice writeup on the IE Internals blog which goes into some of the background to this.

There are mixed reports IE11 supports longer URLs - see comments below. Given some people report issues, the general advice still stands.

Search engines like URLs < 2048 chars...

Be aware that the sitemaps protocol, which allows a site to inform search engines about available pages, has a limit of 2048 characters in a URL. If you intend to use sitemaps, a limit has been decided for you! (see Calin-Andrei Burloiu's answer below)

There's also some research from 2010 into the maximum URL length that search engines will crawl and index. They found the limit was 2047 chars, which appears allied to the sitemap protocol spec. However, they also found the Google SERP tool wouldn't cope with URLs longer than 1855 chars.

CDNs have limits

CDNs also impose limits on URI length, and will return a 414 Too long request when these limits are reached, for example:

(credit to timrs2998 for providing that info in the comments)

Additional browser roundup

I tested the following against an Apache 2.4 server configured with a very large LimitRequestLine and LimitRequestFieldSize.

Browser     Address bar   document.location
                          or anchor tag
------------------------------------------
Chrome          32779           >64k
Android          8192           >64k
Firefox          >64k           >64k
Safari           >64k           >64k
IE11             2047           5120
Edge 16          2047          10240

See also this answer from Matas Vaitkevicius below.

Is this information up to date?

This is a popular question, and as the original research is ~14 years old I'll try to keep it up to date: As of Sep 2020, the advice still stands. Even though IE11 may possibly accept longer URLs, the ubiquity of older IE installations plus the search engine limitations mean staying under 2000 chars is the best general policy.

Paul Dixon
  • 277,937
  • 48
  • 303
  • 335
  • 94
    Note that IE11 [won't bookmark URLs longer than 260 characters](https://connect.microsoft.com/IE/feedbackdetail/view/837865/issue-with-add-to-favorites-in-ie10-and-ie11). I'm unsure if Edge has the same limitation. – Brian Mar 14 '16 at 18:05
  • 12
    Today IE11 cuts my URL to 2048 chars. – AntiCZ Jun 13 '16 at 11:04
  • 19
    in Chrome in 2016 I've been able to open a url with 260300 ascii chars using the osx open command from a simple script, and could confirm that all the characters were passed through to the server. The url in the browser gets truncated to 32791 characters, concludinding with ... (%E2%80%A6%E2%80%A6) – Rob Dawson Sep 27 '16 at 11:19
  • I'm noticing long URLs not work in a web app I am working on. Still debugging but I know it breaks at 4,000 character so I'm assuming Edge 38 has the same limitations as IE11's 2048? – JP DeVries Sep 30 '16 at 21:53
  • 32
    @Paul Dixon It's really nice to see people that are willing to go above and beyond in answering questions on this site. Obviously people are showing their gratitude with the current upvote count being 3734, but I wanted to say thanks! :) – drognisep Sep 25 '17 at 19:20
  • Is GET parameters included in this 2000 limit of URL? – cytsunny Oct 06 '17 at 09:26
  • 1
    @cytsunny yes they are – Paul Dixon Oct 06 '17 at 12:15
  • Is this true for modern browsers? https://stackoverflow.com/questions/46629900/creating-temp-urls-in-single-page-applications – Lokesh Agrawal Oct 09 '17 at 17:52
  • Is the limit inclusive of the length of the URL fragments? IOW, does this answer speak only about the part of the URL before the '#' or does it speak of the total length of the URL (inclusive of the part before the '#', the '#' and the part after the '#')? – kaartic Jan 01 '18 at 14:26
  • As of Jan 2018, IE 11 shrinks URLs, replaced by `window.location` to the 4095 characters. – Roman Bekkiev Jan 18 '18 at 10:15
  • 1
    IE11: max-length for anchor: 5120 bytes, max-length for address-bar: 2047, max-length for copying to address-bar: 2083 – Stefan Steiger Mar 21 '18 at 13:56
  • is a space (%20) considered as one character or 3 characters? – Jun711 May 28 '18 at 17:28
  • Popular answer indeed... Google figures this post is the authority, based on the snippet provided *before* search results when searching for "[maximum url length](https://www.google.com/search?q=maximum+url+length)". :) – ashleedawg Sep 08 '18 at 08:25
  • Googler Hohn Mueller said: "As far as I know, there's no theoretical length limit, but we recommend keeping URLs shorter than 2000 characters to keep things manageable." here https://productforums.google.com/forum/#!topic/webmasters/dPxWiO-cRnM/discussion – Ivan Kutas Nov 27 '18 at 14:44
  • It appears that IE11 and MS Edge 42 (Win10) both allow large urls if you redirect to them.... You can't edit them in the browser (if you type in the address bar, it'll limit you), but you can redirect to large urls (at least 3.5k) – Brad Parks Jan 23 '19 at 16:08
  • Also, if you want to test an url that's 4032 chars in total length via redirect, just go tinyurl.com/ezbigurl11 and it'll redirect you to httpbin.org, with a dump of the request that was just made to that server. – Brad Parks Jan 24 '19 at 14:58
  • I'm noticing that on Chrome, `mailto:` links longer than 2048 characters fail. On Firefox I seem to be able to go up to just over 32K. – Charles T Jun 17 '19 at 15:13
  • Still valid as of September 2019. Just hit the IE/Edge limit on a particularly spicy Splunk query URL. – hiergiltdiestfu Sep 17 '19 at 20:54
  • 2
    This is a really good answer and I'd like to add to this. Even if you forget about Internet Explorer and sitemaps, CDNs also impose limits on URI length. Most CDNs suppor the minimum required request-line lengths of 8000 octets and return 414 Too long request when reached. [Fastly](https://docs.fastly.com/en/guides/resource-limits) 8kb, [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html): 8,192 bytes, [Cloudflare](https://support.cloudflare.com/hc/en-us/articles/115003014512-4xx-Client-Error#code_414) 32KB – timrs2998 Jan 02 '20 at 20:59
  • Thanks @timrs2998, I've added those link into the body of the answer – Paul Dixon Jan 06 '20 at 18:33
  • My old mobile provider used some MITM hackjob cache/gateway thing that prevened me from accessing certain websites, because the URL got too long. It was clearly not even close to 2000 charcters and worked fine over other internet connections. So there's that as well... – PixelSupreme Feb 07 '20 at 10:26
  • 10
    Mentioning any version of IE in 2020 update is ... strange. – Petr Nagy Feb 19 '20 at 15:41
  • What about HTTP/2 ? Does the upcoming HTTP/3 add something new to this subject? – Stephan May 25 '20 at 11:09
  • @PaulDixon As of Jan 2019 Microsoft switched their rendering engine to Blink. Could this warrant another limitation check? Edge is now at version 83 – hitautodestruct May 25 '20 at 11:36
  • Did you come back a few days ago to update the answer? Awesome stuff – Marvin Sep 02 '20 at 10:15
  • 1
    @Marvin yes! I'm astonished this is now 11 years old - I think it's time to review all the information presented, but I believe the core advice still stands. – Paul Dixon Sep 03 '20 at 10:39
  • Kudos to still updating it at Sept 2020! – corroded Sep 17 '20 at 02:46
  • 1
    @PetrNagy Sadly, in corporate environments, IE11 is still quite frequent. – jcaron Nov 26 '20 at 16:07
  • Does this only pertain to URLs visited directly (e.g. the address bar) or does it also apply to XMLHttpRequests? (and fetch?) – Aaron Cicali May 21 '21 at 01:15
181

The longest URLs I came across are data URLs

Example image URL from Google image results (11747 characters)

data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAkGBhQSERIUExQUFRUUFxcXFhQYFBQXGBgYFhkVGBkVFxUXHCYfGBojGRQVHy8gJCcpLCwsFh4xNTAqNSYrLCkBCQoKDgwOGg8PGiokHyQpLDUqKSwsLCksKSwpKSwsLCwpKSkpLCwpLCksKSwpLCkpLCwsLCkpKSwsLCwsLDQsLP/AABEIAM0A9gMBIgACEQEDEQH/xAAcAAACAgMBAQAAAAAAAAAAAAAABQQGAgMHAQj/xABTEAACAAQCBAcLBgsFBwUAAAABAgADBBESIQUGMUEHEyJRYYGRFBYyVHF0lKGxs9IjNEKS0dMXMzVSYmRypMHj8GOTo7LiJENzosLh8RVTgoPD/8QAGQEBAAMBAQAAAAAAAAAAAAAAAAECAwQF/8QAJxEAAgIBAwMEAgMAAAAAAAAAAAECEQMSITEEE0EiUWGBkfAyceH/2gAMAwEAAhEDEQA/AOiaq6q0b0NGzUlMzNTySWMiUSSZaEkkrmbw17z6LxOl9HlfDBqf8wovNpHu0hvACjvPovE6X0eV8MHefReJ0vo8r4YbwQAo7z6LxOl9HlfDB3n0XidL6PK+GG8EAKO8+i8TpfR5Xwwd59F4nS+jyvhhsTaKnX69gzGlUiCc6+FMZsMpTuBYAlj0LnFoxcuCG0ht3n0XidL6PK+GDvPovE6X0eV8MIX0jpQ8pe5SPzeKndmLFl2QuPCpMpnwV1Pg345ZuLc4DbfbG0enlJelp/ZR5EuS3959F4nS+jyvhg7z6LxOl9HlfDDCjrFmosxCSrgMLixsdmRzEb45zQUd59F4nS+jyvhg7z6LxOl9HlfDDeCAFHefReJ0vo8r4YO8+i8TpfR5Xww3ggBR3n0XidL6PK+GDvPovE6X0eV8MN4IAUd59F4nS+jyvhg7z6LxOl9HlfDDeFOsNVMlSmmI1gguRhBJ6zsispaVZWclGLkzzvPovE6X0eV8MHefReJ0vo8r4YR8HOsM6slzZk1sXyhC5KoVRsGQuTe+fRFzhGWpJkQlripIUd59F4nS+jyvhg7z6LxOl9HlfDDeCLFxR3n0XidL6PK+GDvPovE6X0eV8MTarSUuX4TAHm2nsELn1vkA/T8uA/8An1RFommbO8+i8TpfR5Xwwd59F4nS+jyvhiTRabkzckcE82w9hibeJIFPefReJ0vo8r4YO8+i8TpfR5Xww3ggDlfDJoCmk0MppVPIlsahRdJUtDbi5xsSq7LgZdEET+HL8nyvOU93OggC3an/ADCi82ke7SG8KNT/AJhRebSPdpDeACCCCACCCCAKJwqawtIpxKlmzzSF+sbD7Yaal6spTyJeWdt/PvY/pE3zig8LVYe7pSnwZZlP1XzPqMdfoyMC22WFvJHZnjoxwS8qzDG9UpG20J9YNWJVWJfGC5ltiXmB57b4cXjwuI5E2uDdmqlplloFXYP6vCys1slI5lqHmzB4SSlxlf2jsXtjXrjpjuelmMu2xAPNkbwk4M9HiZRS5r5mZdzfezE3Y9OQjFybnpR0RxKOLuy8ukNqTXymeZxTFpT3ACzVKZndfZ64sQaKRwk6qpOpjNVbTJViLb1ORB6M7xp4NdZ2mULrNbE9OxTEdpXIrfpAyjKWftatfhWbz6eMsKzY/emvZ/BcazSySzhJJb81QS3YI0S9Y5RNiSh/SFor2qMs1Lz5sw35ZFvJYAeS1oe6Y0KjSyVADKLgjo3Rjrzyw92LV1aVePa/c5tMVLSyfWKXlOEbCzIwVttiQQG6iQYrmite0s0qpWZKnyrK6lGYMdheWUBxKduwbYhauadaUKqSxvxKmYnQLG69RF+uIPBtO7parmOxLcacWZuRYYc+a149Ho5xz9P3mttjnypwyaCfrFwlyUllJAmTJrghbIbKdmJt+V72tfKGOkq7jNGs3K/FgXZcJa1gWwnMXil8LGglpml1cnkNfOxPhLmrdYuOuLdpScH0WXC4caKxHSbXjbq4QWBSh5TOWUpOM78IW8Dy2o2PPMf/ADGLTpLWWVJYIcTzCL8XLUs1ucgZAeUxTuDOr4rRkx/zS568RiHqTpRWFTOmiZMZpzDAiMxbCAADuA8pG0xwRnUYx+D0elwt4VNq+FXyXGh16ppk0SSWlzDkEmLhueYHZG/SGlicSICtiQW+G0UzT2hGrp0l3lrTy0a5UHFNcAg2YryU2biTFolSYjuSTaZ05MOPZw9t1zT+GaHpYW1VHDubkIV1c6M3ImMCu18gizC4YG9wbeyLFqhrizsJM7Nrch/zug9Iiu11VmemFAurFkyIs6nmYfbGkMjM54juAa+cewk1V00KiQjjeBlzHeIdx0nIc64cvyfK85T3c6CDhy/J8rzlPdzoIAt2p/zCi82ke7SG8KNT/mFF5tI92kN4AIIIIAIIIIA5zwvauNNlJUS1uZV1mAbcBzDdRHYY38GOuizpCU01gJ0sYVufxiDYQd7AZERfZksMCDmDkRHPNYOCWW7mZTM0lib2U5X6Bu6o7YZsc8fay+OGYSxyUtUToM6XiBFyLjaDYjyHdHONddCGkp3mynYFib3dmOYO0sY3UGh9LSrKatmX9KUjntOcStJ6lz6xQtTPmOozwnBLW/OVQXPbEYWsM1LVa+xNOaqtxBRaPmT9X1KZsLzCMyW24yScybeyHHA9plXpWpyRjkMbDeUOYbtuItmrugVpadZK+CosN+XXCHSXBtKM7j5BaRMOZaWxTM7TzdUcE05ZHkR6WLLHsdia/p+w41x0ikmjnO5AGGw6SbWA6YpvBroRxSVDlbNOYuFP/KPqj1xYU1JDlTOZpjLseY5mEdKqeSD1RZqWjWWoVRYe3yxnPEsl6/KojvaMfbg/Nsp2olUEnTpRyxHGvl2FfLleLjVTQqszEAAG5hJpjVBZr8ZLJlvzqbZ88Ytq7MmLhmuXH6TXH1RYHrjnxY82LH2tnWyfx8ozlKMpaiv6o0gqKmpmkXlODLAI2oARfrv6oXaO0BV6KqneSFm0z3xBiQcIzBuAeUBlsi+VE6TQU7OfBXM2tdjuivUWl6ytXEjLJlsMlWWJj2OwsznCMtwEel0WN9Ph7afo4d+f9ObM1OV+RRPqzpqfxZssqnYHiwTy2P03O3CN1t8W7WemEvR8xBsVR7Y5vpnVSr0a/dUh3IBzay4gDnZlXJlPNF/oXl6X0chcEY/CUMygOhIOzMi49cb9biUoasT9PC+DnqUoyxtb0JODSk43Rc1B9IzFBvvubeu0V7g802tLUzqaq5CzGPhbFm3sQ3QRsPRF+1a1IWiYmWzWP0cb4c/0L2v02jXrXweSK04yMEze6mxNufceuPMeOXpa5R6vR5owxPDmWzrjw15J+lVXFKC2w2JFrW5oJZGy47YqWh9Adz8bIEyYSrjGWYEgYTYIdwNt0LNKz6FTKOCdeYSEYTJlmNyuR35g5gWy2xST1S3NIxUVtx+C/T5eUVzTFRLl+G6qL2zYCJU6rEulZgzWOdjmRkMrxR9HFKlsU2Xju1uUSVHlF7DymKVZpdGVfpaVc4ZinyGIPddwc/6Ee6T09Yuq0glKpw/ixn0hgPbzQvH5wyB3RpwZ6tzofBlWZMm4MfWL/wAY6VHHNQtIKk4KTYuSV6cIF/bHYZZuB5I6Yu0ck/5M55w5fk+V5ynu50EHDl+T5XnKe7nQRYoW7U/5hRebSPdpDeFGp/zCi82ke7SG8AEEEEAEEYlxzxlABBBBEALQR5eAGJB7BBBABBBBEALQQXgiQVDhO0TNn0TCVclTdkG1lNwcPSL36oS6k8ItOlOkmovJmSxhJZGCtawBFhkbbiI6QVhbU6uyHNymcdEcq0aJq0uK2Zk4PVqiV3T2tcupkTJNIGnNMUqXwsstAcsbuw3bgLkwy1E0GaWlWWTf+JOZPrhrI0NLS1lvbZck2iaIylNadK2RdR3t8nsEEEULFWnSFM+ffeQD2GMpuhlIAsAo5gBlzXHkjXpCdhqnXebPboNgD2gxPefYZ9sceTaTO7FehFU10YrTHDsJt1C32RSdXp9mYc8XjWqtx0zIsss+wEbL3238m6KBTKUmLjBUre/ST7ILgv53LXO0YHF3ucss4q+l1Cmw2RapGkA6AA8q2Qio6Xzc9Bt5TviIkzqtjdq4v+105uLhZuEb7MLE2/8AjHdtHNeWvkjiuq9F8tKJWzIGud/KyC+2O2UIsijojpx8HL1D9X0UHhy/J8rzlPdzoIOHL8nyvOU93OgjQ5y3an/MKLzaR7tIbwo1P+YUXm0j3aQ3gCp8KdS0vRdSyMUYcVZlYoRedKB5S5jK+fNCXSOsLUFItTK4ppMuotULIqHrCUZCos80DAwcrcXAtvztHRHlgixAI5js7IwSlQAgKoB2gAAHqEAcb1jrp7tR90CWZz0tHMdwmFrtpCRZM7WADLdbbRHaYwaSpNyATzkA9PtzjOAPGin1MyeJkyWhc8TNaoOZJeW9mSWoxb7zkCnI8Xui4GFj6GYknuioF9wMrs/F7I0xSUW7IZUqXWGeJrWayvNWZLVmk2aXNK2/GNxjDDcjixbMb7xP1O0g1qWWJqTVMi7KoT5EyxLCqcJJucTA4t6mwEO//QDcHuifcbDeTl5PkozpdCYGDCdOyIJHyVjbcbSwbdcdE8uOUaVfv0VpjSFGtrgUNUS2G0qYQwYoQQpIswIINwN8N4iV9FxoAxug34cGfQcStHLFpSVlytz9IzhMKypwWWJlPJQBUfKbLU8YHa5Yi5tckZb4j6R1pmJIQ4ysxePJ+bqr8U8xFznEXJ4u5CZjF5IsI0EfGKjtlbtn+6jFtXyds+efKZJ27dsqOpTx7N1+/RSmIpeskwvKPGqWeZNU02BclSXOZGvbGL8WhF9uI2vEGVrTUMFJmqqsoZrzKLjFY4TgRceG1i1+Ms1lFhe8WQaorxvG8fUl+czVIGWG4QphBsSLgXzPOY3HVz+3n/4Pb+Ki/cwrwvwKYxoJuKWjXJxKpuy4WNwDcr9E9EbzGumk4VClmaw8JrXPSbAC/VG0xwMuUzTdVhaod85stxxEsz5kktLCI15SrcTH4zGNhvax6d0zSk/C7tNVENS8gHAlpUtHmDjGZrgnkgXPJswyvnDifoQs2Ljp4zuADK5PQt5ZIGXPGJ0ESCO6J9t4vK9nFR1KcKVlXYiXWp0l1Reah4uU5kTCFHGspnDGoGT5LLyUWj06wzcb2nSrrPWWJBCg4GWXd3+kApcm4ysM7xP0nSS5CY5lTPAXwR8iTnuUcXHONIaVeYZhQnAz48LsCS1gCWZFG4DLYIs8mKm0v38EVItNPrJLngo08PPWYFw/I3HJJKq0o2I6Cb7Lw7Zi6qVwm4yxXtfdsjiOg+TxyDkTVmNMA27TiRhzi/tMdH1a1pWalm5MxTy0/wCpT+bv6I8zqPVLUkd2HZUT5GlFbkTJ3EzACcJkckEEA4XPhWvz3is611AViEm8cxa2Li1VQNoNx4RzbZvt5YtdUVmqWlulmzuAHUkb7g7coqWkKeWXzmYiLliLBcs7WG0xlqS2OpRT3Na4ZUlXxctLn9okWAPRe3ZCCvqklhTNJCKQXa1zcnM2G2NldX3O3krdid2UUjTmluOLAeABl0n84xeKt2c8nsz6C1Nl0tQomSJsqYciQrAsLD6S7Rs5ovKCwA5o+KqKodGDS2ZGGYZWKkeQjOOj6tcLmkaeweYJ6fmzRdrc3GDPtvHSculs6Xw5fk+V5ynu50EUzhA4S5VdQy0Mt5UxZyuRcMpASaDZh0sNoggZ7nYdT/mFF5tI92kR6/TdQKlpEiTLmYZaTCzzTL8MstvAN/AMSNT/AJhRebSPdpEel/KlR5tI95OgSed31/itP6UfuoO76/xWn9KP3UWCCAK/3fX+K0/pR+6g7vr/ABWn9KP3UWCCAK/3fX+K0/pR+6g7vr/Faf0o/dRYIIAr/d9f4rT+lH7qDu+v8Vp/Sj91FgggCv8Ad9f4rT+lH7qDu+v8Vp/Sj91FgggCv931/itP6UfuoO76/wAVp/Sj91FgggCv931/itP6UfuoO76/xWn9KP3UWCCAK+dIV/itP6UfuoS13CBOlXvJp2I2hKh2PqlW9cMtfdYVppABcIZmWInYv0j6wOuOYStYqViAJ8u53YhEWTRbDwutn/swv0zPblC6o4VKt/ASVLHkZj2kj2QrqKVZq4kYXGxgb9ttxiFTycQOQBU2ZeY/YYgskGlNM1E9g05yencOgAbI1Sap9jHLyf1eJiy4yFOPsgSJNJ6NLMsxDZl2Hy7jDvRmqM+fKE2eDIyay3znZHaV5UuWd9uVDLQmjONmiw5KWLeXaF8tob6114lSWNwMKk3PPuvHPknXB1YYXyc/07rQaGR3PT2AxNeXyisoG1wrsLsCdzZiKgNcJh2gHovYeqOoap6ckv8AIEKzTXyVwrBhhzOEjZySOqKPwlavJIrDxUsKjqrBUFgpO0gbBfmhjab3W5pkUorZ7COq0tMnrhICrfwVvn+0d8QahcK9JyESqGUQGFiLgWvYbNufkiVRaPUsCflWO4eCv2xvwcz3FujtFO1ssosFPo3CNkOJFOBlbsiZLpgd1rwsrwioaelWlL+2PY0ETdcZGBR+0PY0EKIs+kdT/mFF5tI92kZpoxlq5s8FSHlS5YXO4wM7Xv04/VGGp/zCi82ke7SG8XMTVd+Ze0/ZBd+Ze0/ZG2CANV35l7T9kF35l7T9kbYIA1XfmXtP2QXfmXtP2RtggDVd+Ze0/ZBd+Ze0/ZG2CANV35l7T9kF35l7T9kbYIA1XfmXtP2QXfmXtP2RtggDVifmXtP2QYn5l7T9kRNJaWEsWGbc3N0mEFRpac30iP2cvXFJSSLxg5FU4SaHumt4uaGwy5ahbbATyiT1xUX0bKkgyp8mXMlm9pgQXHltmLDeIuWmtDGYSxuzHeWN8umKvpCna6WDq6XIzaYrdDKcz5RcjmMUU0zTtyiRdH6O7lzkkGXcG5bYpOV3GWG+x7W3GxhnUPgmJNwkKxEuYDbYckfLI2YjPpiLo1iclFjmyW5UsN9JMW5W3qbEcwiZUUSsmFwVDDlIp2E9MaIqe1MmxjCXTTLE2sADmSPZv5+qNrTwtibCwsOoWHsjyTpEXvfqiBwXvRdMsmSoWxFr4ucnMt1xzzhM0gWlcWubTGw+u/8ACJtJrM8pWkk5LmpP5jZqOrZ1QvKrPmLMfwUuR0k9EcMnUj0scE037lU1So6iRWUj4bAzFS+f0iRn0ZmLVwgU6zJs0XyliQo8pdsgfIYx03VJLVSHCFSCrE2sQdsVzSOvTOWAXjQxQsxGHOXe2Dy74v6pu0iXogqbNOlKWQJqSZbYjblqc1vuGLn6Ilyacy7XXaPCGy/SBshNoLRxLYzfEST2xdaWVlHStlRwTlbtI1UtM3QOke2J8pAvSeeIk2fhuu4WYeQm3qJ9cbUfKJM2VnXcEoDb6Y/ytHkb9dE+QX/iL/lf7I9iSD6F1P8AmFF5tI92kN4Uan/MKLzaR7tIbxczCCCCACCCCACCCCACCCCACCCCACNNXUiWjMdwjdFd1hqiXWXuAuf66orJ0rLRVuhepaYxZjtziSKYAXMFNa1zYdMJtKa70Us4GnYmzylqz7OlRaOa7Ot7bInT7bB64q+nESxuCNljzEbxzQ6k10uYgmoxKkb1IPWDsjnusGn509mEviJUtTYzJhzJ/rdaKqLZdyomaO0gXuv0lyY725mJ3kwweVgBLbeaKlq5UOs+7MrclswLBh/2MWOqqMUdEeKOaS32E+kKs3MRJFbYxhpR7XhUk/OBdIbaxVWGUk4C5QlWGzJtnrv2xWDrZUNbDhHNlf2xYhVo0tkmHJhY9Ytfq2xTaeyTCh2gkQUU92Rqa8ktKabPcNNYsen+Aiy0ur4w7B/XRGjRbDKLJStEsiyFQ6NwQ2krG1ADGdoEEGvTIE7M1bnwttHq7QIjUk3aMsjbKJ1QpIOz/wAZ/wAIU0rWII8Ell+rYr/yMo6oENETXH8Qv/EX/LMgjVrY/wAiv/EHsmQRJU+iNT/mFF5tI92kN4Uan/MKLzaR7tIbxczCCCCACCCCACCCCACCCCACCCCAI2ktIJIlTJsw2SWpZj0DmG8nZ1xQ9FV06oxzZieEz2IZWUKLALcbCM8vth5wiOO5kUnJp0rF0hG4wr03wWhZQYjLliWyqgVsa2uSLckDPLbc9cYZW+DpwJNskzKdZkoq+ak3YZ5gbsorGlqKo5HEy5EhA2fJVppG4g7Fi20RHqjHS6y5aGY27dvJOQHbGG5vSIFIjvSGXNILMpBPSRutHJ6PRGF2lsFLKx8LM7TZgLx12bWGWoxAGwJYXOX6KhRY+XojmWtrsanjVTApCEc9xe/tjSNoidPcgz6cSXuOSDtPSdvrhgKvLtiLpar42QjsAM8+Y2F8vqwpl1eIReBSaR7paqGcV6dXc0SdKV6DInEfzR/HdCGfVYtgsPXGiRk5JEv/ANQzzMRqipxOGG3n540IhOzOJlLo5rgmJpGdtj3RM05RaqJ9kJNG0NgMosFLIirLDKSY3mNUhY3QLGphCgyQFmS+kzFO84Lkj6hb6sOmtzQs0rNw4XIyUi/kG0fVxwIsrGtE+8hel1PYr/bBGjWRMMsp+ZNw9gbP2QRJU+mNT/mFF5tI92kN4Uan/MKLzaR7tIbxczCCCCACCCCACCCCACCCCACCMZkwKCTsGZPMBHL9M8KFUj4pcgcRnZsLM5A2Ne4HVaIbolKyx8J8g9xiYL/IzEc/snkseoNfqip6L00qSprXJIQ2A3ndaPJuvU6rknip6EOpBUykZTfapG7LKKVU6Sm0qEPJJVd6E7M8yG2Z9MUmlI0x3F2dXoaobbixF73sPXEfSFfLqMBluk0SHuwVgVBIKjEwyyN8oV6BoDOQvjIp3QsQcjY58l/orbbeEentEzzTzZVCVlyULTLl+XMxMzcmwyPhZnIgC0ctNbNnb/LeiyS9L8ZMeXxb4EyLS2DMx/NXZbrMUrXKRLIPFpMF7hnd7ta4soW5z3E7umHupFSkuQsmbMCTAobDiF2VxcOrHwgYg61PJlqZha43AsLX3xZNJktbVRWa2eeIKW8HG5G+wTPsAikVWlGa4GQ9f/aGtVrNdjgBINw99hUixUDpBOcKe4jcb75jMEkbjtjoiqVnHOduiOkgnZEyRoy5zhjQ0UP6XReyLWRSFtBoQc0O5OhgAMomU1HhhnJl5RWwQaaitu2QwlSbRmsrbG1RAbGKrAWj1oxw5wDMTOA3wk07Xji2sCfZmCP4w5NGp2mItfopDLdQCSykDywRUpes98KEjNlkMfKZVifrAwRt1sQ8XTk75YHUjTQPbBFgfSup/wAwovNpHu0hvCjU/wCYUXm0j3aQ3ixmEEEEAEEEEAEEEEAER6yvSULu4UdJ9g2mN5jmGuPGPVzFLELkMtoWwyHNe+ZgBjrBryZyTJVKBYgo01mK2vkQoCm5t2RU6PRzISWfFcWwm5C8+Em1weYqIYSKUKBYWAHJXmHP5Y3NLvbCL+zrivJZbFfp9XpSzMa3XI4jiwLYZ4mUc3PD/VWZJqJU2fhunGFUxC+JJdhjI/Sa58kIeEClcUE0qxBDIZgX/wBsmzD2Hqir6P14aRSKktOQOTibJSeYWzYxnkTpJHRhatuTOx6fnKlFPGXKlMNmXLFrW3ix2RQNBz5lLo6peobGzLxcpDbGoIIQdNy+Q6Ir0jXPSFUi8iW0sEZEEXw7iQbndDebo+qqQHnTBLtmqyltZtxLG5yO6MtEmzdZIRWwv4SdFsJdMLANT06BiLfo5AjMi5aKJS6Omzdocrz5ke2LbP1QdzypztuN2LXt5TzwxotD8UAAY2itKowm9TtCSi1WVVzxXPOsZzdXbC46ujp6IsoQ3zjY8sdkWszoq66OZTcE23DbDPR1Q+NFZMiwBN7WB3wyMiMRJOVjY559Fje3qiCRhS4XF12XI+qbRLWTCXV2vExZgAsVc3XmxAW9Sw8R4FWzUVzjLDGUyMWgQYPGlo2PsjVigSjB0J2Rom07WzcjyRumOd0RZxO9rQQKjrI5NNTm98M2ol59Dlh6ngjTrBOvSfs1Tj60tWv1wRcg+ntT/mFF5tI92kN4Uan/ADCi82ke7SG8SZhBBBABBBBABBBBABFA1vlWqybZlFNycuY5b90X+KrrzoZ5qpMlDE8u912YlO4Hnv7YEoqZmDfnEWv0sJY5TLLHSQIrGmdYpiXUypyNzlMI6nYgdkUvSemHxZBAx2G/GOSeYnZFbL0W3TGvKKpwqZl7i7AhSDlaxzYGOe1pdwGK4VXJVGxbnd1mL5onUc4VadczGFyTc2vu6IZay6qqKOYFAxWuOrOJJ2o91V0ZhkJ6uuLEq2hdqNVcbRym3qMDeVSYczEteIoiyvTB7THkoA57hGufMyyjLQrpMqJcqYWCvcEqM72JFtu+Ktl0nZJ4sWuRGlpUM63Qc1GAU4kPgllIbfttcbo1Po6YQMLSzf8AauOgjdGfcj7m3Zn7EBTESsrOLRiou2xRzsxFvYYw0hPmyWImIR+kMwemE1Fp5nntLSWrPiBR5hISWqqbuQNubHfuEXW/BjK4umM9ELMlTFM0j5RgpFrZkgAk7znFmEUDTelpTVEsS2edxIQqEyDzr3ZjkbKMrW23i26PrnYIJoCzGUtYAgXv4Iub3sR5bGJoqT5hyjXijya2XZ7Y1loFj2Y8aXaB22xGaZeBVmUyZEOeyjMtGUx4jzp6jdc3ggVTTDA08y17d0j3WUEeaRe8qcD4wp/wzBFyD6m1P+YUXm0j3aQ3jjOhOGviaanldyYuLlS0xcfa+BFW9uKyvbniZ+Hn9S/eP5USZnWoI5L+Hn9S/eP5UH4ef1L94/lQB1qCOS/h5/Uv3j+VB+Hn9S/eP5UAdagjkv4ef1L94/lQfh5/Uv3j+VAHWo8ZARYxyb8PP6l+8fyoPw8/qX7x/KgDoOldV5M9SrorA7mAI7DHNtIcGcmlq+OC3VjdUOxWHN0b7RI/D1+pfvH8qEmsHDDxzJelsFGQ4++Z3/i4EofvttGGk5eKWR0X7BFK/CaMV+5z/fD7uMn4T/1c8344fdwZayZwZvZamUfozbjri21Y5LdAMcr0JrqJFRNdZJIbavGW38+Dp5od1PCeGVh3MRcH/fX/APziEHyTpi5eS0RtXah0r5BlhSWYpyycIDixPJzBtCl9eBhtxG3+1/0QrbWrlAqjKQRZhMsR0g4cjGbWxrF0z6CSVMBPGFDllZCvPvJN4rFU6hyN4Ym4y6M4rVNwrpLyWkbmN6t3v9dDCbTPCIZkxmEnDls4y/8A0COVwZ3RypeS+mSk9XJyFsIJ9ov0xzuroFxvLa112dKnMRjo3XtsT4pZZQQQvGWtl0qcoX6w61ibMSYsoowGE/KAgjIj6A2XMbYk06Ms8oyjZIoQZFwlwp2hSUcdIcZnyHKM9I6XqJeAy5gmS3ORmAYwwzKO4355c8KH1iuPxeY34/8ATEd9NXlzUKZTBfwvBZSLMMtucbnEdGpaovKRmtcjlW2XGREeu0U3R+t+GWimVeyi54y1znnbDG5td8/xJ/vB8ERRNloZo0WiuNrt/Y/4n+iPF1z/ALL/ABP9MKILCZF9sApQd1+mESa4DfJJ/wDst/0RtbXUW/En+9/0QLEPT1EqSph3mel/7t4Ig6X0+JqOOLteYreHfYrC3g9MeRJFH//Z
Steve Konves
  • 2,568
  • 3
  • 23
  • 43
CyberJunkie
  • 18,604
  • 50
  • 135
  • 207
  • 42
    He's talking about the fact that a base64 encoded jpeg is technically a URL, because it's specified as data:*. While he's correct in stating that it is a valid URL, I don't think that's what the question was asking. – Fitblip Jan 08 '13 at 08:24
  • 55
    ... or just paste it in your address bar. – Gras Double Jun 27 '13 at 01:49
  • 68
    Because a data URL contains the protocol "data:", and the identifier, it's everything you need to LOCATE that "file" (even if the "Filesystem" is the space of all possible files). It is therefore a URL, which is also a URI. (But definitely not "not a URL") – MickLH May 24 '14 at 18:19
  • 6
    @DoubleGras Google Chrome for Mac does not allow me to paste a URL that long into my address bar – Max Nanasy May 27 '14 at 23:34
  • 2
    Thanks for the info. I've just tested it successfully on Firefox and Chrome, Windows. So… it simply depends ;) – Gras Double May 28 '14 at 12:09
  • 1
    Hmm. This *could* be considered an answer, but it seems fairly clear that the OP was asking about URLs using the `http` or `https` scheme... – SamB Jan 15 '15 at 00:20
  • 1
    The Chrome extension "Webpage screenshot" previews the screenshot as a data URI. A page 32708 pixels high (1263 wide) became a PNG 8,749,309 bytes (8.34 MiB) in length. In base64, that's 11,665,748 characters. Add in the `data:image/png;base64,`, and you get a 11,665,770 character long data URI. – Cole Johnson Mar 03 '15 at 04:05
  • 2
    I cannot even paste this in current Chrome. – The Onin Dec 14 '16 at 00:37
  • 1
    A few firefox versions ago I generated a 2MB URI image. You could display it on a page, but pasting it to the address field\opening in a new tab, resulted in a crash every time I tried. – jahu Jun 06 '17 at 08:40
  • @Nino Škopac It's working in Chrome Version 76.0.3809.87 (Official Build) (64-bit). Pasting it into the location bar displays a cartoon of the Google home page. – George Jul 31 '19 at 03:51
  • Applause for the "Is this information up to date?" section! I have never seen this before, but this is crucial in fast-moving tech. – Brian Risk May 06 '20 at 15:16
  • 2021.02: The image url in this answer **does work** in Chrome 88 on Mac – Larry K Feb 25 '21 at 06:42
  • Is that.... Sergey and Larry? – rgshenoy Apr 06 '21 at 09:07
168

I wrote this test that keeps on adding 'a' to parameter until the browser fails

C# part:

[AcceptVerbs(HttpVerbs.Get)]
public ActionResult ParamTest(string x)
{
    ViewBag.TestLength = 0;
    if (!string.IsNullOrEmpty(x))
    {
        System.IO.File.WriteAllLines("c:/result.txt",
                       new[] {Request.UserAgent, x.Length.ToString()});
        ViewBag.TestLength = x.Length + 1;
    }

    return View();
}

View:

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>

<script type="text/javascript">
    $(function() {
        var text = "a";
        for (var i = 0; i < parseInt(@ViewBag.TestLength)-1; i++) {
            text += "a";
        }

        document.location.href = "http://localhost:50766/Home/ParamTest?x=" + text;
    });
</script>

PART 1

On Chrome I got:

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36
2046

It then blew up with:

HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long.

Same on Internet Explorer 8 and Firefox

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
2046

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
2046

PART 2

I went easy mode and added additional limits to IISExpress applicationhost.config and web.config setting maxQueryStringLength="32768".

Chrome failed with message 'Bad Request - Request Too Long

HTTP Error 400. The size of the request headers is too long.

after 7744 characters.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36
7744

PART 3

Added

<headerLimits>
    <add header="Content-type" sizeLimit="32768" />
</headerLimits>

which didn't help at all. I finally decided to use fiddler to remove the referrer from header.

static function OnBeforeRequest(oSession: Session) {
    if (oSession.url.Contains("localhost:50766")) {
        oSession.RequestHeaders.Remove("Referer");
    }

Which did nicely.

Chrome: got to 15613 characters. (I guess it's a 16K limit for IIS)

And it failed again with:

<BODY><h2>Bad Request - Request Too Long</h2>
<hr><p>HTTP Error 400. The size of the request headers is too long.</p>


Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36
15613

Firefox:

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
15708

Internet Explorer 8 failed with iexplore.exe crashing.

Enter image description here

After 2505

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
2505

Android Emulator

Mozilla/5.0 (Linux; Android 5.1; Android SDK built for x86 Build/LKY45) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36
7377

Internet Explorer 11

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)
4043

Internet Explorer 10

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)
4043

Internet Explorer 9

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
4043
Frederik Struck-Schøning
  • 11,909
  • 7
  • 55
  • 63
Matas Vaitkevicius
  • 49,230
  • 25
  • 212
  • 228
  • 1
    So, in effect, my assumption of 512 chars is largely wrong ^_^ Thanks for the test. I will never care about the query param length anymore.. – Gogol Sep 17 '15 at 07:19
  • 21
    This should be the accepted answer... the first one doesn't actually provide hard limits for each browser which is what the questions asks for. – GrayedFox Apr 08 '16 at 09:23
  • 2
    Might be worth looking into Safari too. Safari is the only browser that does not support client-generated downloads. The workarounds are: a) open a BLOB URI (a short, temporary URI that points to an in-memory Blob) in a new window, b) open a base-64 encoded data URI in a new window (may be very long, but supports mime typing). Details here: https://github.com/eligrey/FileSaver.js/issues/12 – Mat Gessel Sep 28 '16 at 18:16
  • 1
    @Vaitkevicius do u know if a space(%20) is counted as one character or 3? – Jun711 May 28 '18 at 17:26
  • 2
    @Jun depends where... press F12 and paste following into the console `console.log("%20".length +" "+decodeURI("%20").length)` this should explain it – Matas Vaitkevicius May 29 '18 at 02:06
161

WWW FAQs: What is the maximum length of a URL? has its own answer based on empirical testing and research. The short answer is that going over 2048 characters makes Internet Explorer unhappy and thus this is the limit you should use. See the page for a long answer.

Brian
  • 24,434
  • 16
  • 74
  • 162
99

There is really no universal maximum URL length. The max length is determined only by what the client browser chooses to support, which varies widely. The 2,083 limit is only present in Internet Explorer (all versions up to 7.0). The max length in Firefox and Safari seems to be unlimited, although instability occurs with URLs reaching around 65,000 characters. Opera seems to have no max URL length whatsoever, and doesn't suffer instability at extremely long lengths.

  • 9
    If the instability is around 65k it is probably right there near 65535 (2^16 - 1). Maybe they loop through chars using short i? Just a thought. I wonder what URL they tested for 65k+ o_o;; – Garet Claborn Mar 18 '11 at 11:46
  • 6
    This answers is maybe the one that should be accepted, as it provides the concrete answers: 2k for IE, 65k for Safari/Firefox, "more" for Opera. – eis Apr 15 '13 at 06:20
  • 1
    I'm curious. Is the 65k URL a data scheme URI or really a URL in the classic sense? – SaAtomic Sep 14 '17 at 10:50
  • I'd guess the instability is/was caused by API used to render the address bar. Many OS libraries cannot cope with overly long strings to be rendered on display with acceptable performance. – Mikko Rantalainen May 21 '21 at 15:37
93

On Apple platforms (iOS/macOS/tvOS/watchOS), the limit may be a 2 GB long URL scheme, as seen by this comment in the source code of Swift:

// Make sure the URL string isn't too long.
// We're limiting it to 2GB for backwards compatibility with 32-bit executables using NS/CFURL
if ( (urlStringLength > 0) && (urlStringLength <= INT_MAX) )
{
...

On iOS, I've tested and confirmed that even a 300+ MB long URL is accepted. You can try such a long URL like this in Objective-C:

NSString *path = [@"a:" stringByPaddingToLength:314572800 withString:@"a" startingAtIndex:0];
NSString *js = [NSString stringWithFormat:@"window.location.href = \"%@\";", path];
[self.webView stringByEvaluatingJavaScriptFromString:js];

And catch if it succeed with:

- (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType
{
    NSLog(@"length: %@", @(request.URL.absoluteString.length));
    return YES;
}
Cœur
  • 32,421
  • 21
  • 173
  • 232
  • 86
    You sir deserve a +1 just for the effort of trying a 300MB URL – Дамян Станчев Nov 10 '16 at 12:57
  • 4
    iOS isn't a browser in and of itself. Was this in Safari for iOS? – Randall Aug 07 '17 at 14:21
  • 7
    @Randall schemes are handled by the OS and then dispatched to the app that can open them. So all apps on iOS, including Safari, can handle long URI. – Cœur Aug 07 '17 at 14:35
  • 2
    Thanks for the clarification. Presumably, though, this doesn't prevent an arbitrary app (say, eg, a Tor-powered browser) from introducing its own length restriction, correct? – Randall Aug 07 '17 at 15:13
70

The URI RFC (of which URLs are a subset) doesn't define a maximum length, however, it does recommend that the hostname part of the URI (if applicable) not exceed 255 characters in length:

URI producers should use names that conform to the DNS syntax, even when use of DNS is not immediately apparent, and should limit these names to no more than 255 characters in length.

As noted in other posts though, some browsers have a practical limitation on the length of a URL.

casperOne
  • 70,959
  • 17
  • 175
  • 239
55

The HTTP 1.1 specification says:

URIs in HTTP can be represented in absolute form or relative to some
known base URI [11], depending upon the context of their use. The two
forms are differentiated by the fact that absolute URIs always begin
with a scheme name followed by a colon. For definitive information on
URL syntax and semantics, see "Uniform Resource Identifiers (URI): Generic Syntax and Semantics," RFC 2396 [42] (which replaces RFCs 1738 [4] and RFC 1808 [11]). This specification adopts the definitions of "URI-reference", "absoluteURI", "relativeURI", "port",
"host","abs_path", "rel_path", and "authority" from that
specification.

The HTTP protocol does not place any a priori limit on the length of
a URI. Servers MUST be able to handle the URI of any resource they serve, and SHOULD be able to handle URIs of unbounded length if they provide GET-based forms that could generate such URIs.*
A server SHOULD return 414 (Request-URI Too Long) status if a URI is longer than the server can handle (see section 10.4.15).

Note: Servers ought to be cautious about depending on URI lengths above 255 bytes, because some older client or proxy implementations might not properly support these lengths.

As mentioned by @Brian, the HTTP clients (e.g. browsers) may have their own limits, and HTTP servers will have different limits.

Greg
  • 295,929
  • 52
  • 357
  • 326
47

Microsoft Support says "Maximum URL length is 2,083 characters in Internet Explorer".

IE has problems with URLs longer than that. Firefox seems to work fine with >4k chars.

TRiG
  • 9,249
  • 6
  • 50
  • 101
MegaTux
  • 1,402
  • 23
  • 24
39

In URL as UI Jakob Nielsen recommends:

the social interface to the Web relies on email when users want to recommend Web pages to each other, and email is the second-most common way users get to new sites (search engines being the most common): make sure that all URLs on your site are less than 78 characters long so that they will not wrap across a line feed.

This is not the maximum but I'd consider this a practical maximum if you want your URL to be shared.

Paul Morgan
  • 26,842
  • 3
  • 22
  • 27
  • 4
    I wonder where "78" comes from? Maybe that original 1999 article was written under the assumption that people are reading their email in 80x24 terminal windows? Still, good advice! – Jon Schneider Jan 28 '15 at 21:23
  • 4
    Well. IBM punch cards were also 80 columns. With two characters taken up by a carriage return and a line feed you get 78. – Paul Morgan Jan 28 '15 at 21:39
  • 2
    Haha. :-) I was actually considering referencing 1981-era 80x25 CGA monitors in my comment, but you reached even further back! ...I wasn't around for the punch card era, but were they 80 bytes across, or only 80 bits? – Jon Schneider Jan 28 '15 at 21:43
  • 2
    Not exactly a byte (8 bits). It encoded one character in each column. – Paul Morgan Jan 29 '15 at 08:44
  • 4
    @JonSchneider - 78 is quite specific, and may relate to readability of text (from a usability perspective given Nielsen's background), which is best between [50-60, and a maximum of 75](http://baymard.com/blog/line-length-readability). – Jay Rainey Mar 16 '16 at 13:06
36

Sitemaps protocol, which is a way for webmasters to inform search engines about pages on their sites (also used by Google in Webmaster Tools), supports URLs with less than 2048 characters. So if you are planning to use this feature for Search Engine Optimization, take this into account.

HoldOffHunger
  • 10,963
  • 6
  • 53
  • 100
Calin-Andrei Burloiu
  • 1,411
  • 2
  • 13
  • 25
  • This is a little confusing. Sitemap protocols "supports URLs with less than 2048 characters." I imagined a site like example.com would work. I think this question is more about the maximum? – HoldOffHunger Aug 17 '18 at 17:21
19

ASP.NET 2 and SQL Server reporting services 2005 have a limit of 2028. I found this out the hard way, where my dynamic URL generator would not pass over some parameters to a report beyond that point. This was under Internet Explorer 8.

Peter Mortensen
  • 28,342
  • 21
  • 95
  • 123
Fandango68
  • 3,464
  • 2
  • 32
  • 54
18

Why is the Internet Explorer limit only 2K while IIS has a limit of 16K? I don't think it makes sense.

So I want to start an experiment about Ajax request URL size limits.

I have set my Tomcat HTTP connector's maxHttpHeaderSize="1048576". And prepared a very long URL.

Then I send a request with the long URL like the following:

var url="/ajax/url-length.jsp";
jQuery.ajax(url,{data:{q:"0".repeat(1048000-url.length-4)}});

jQuery reports done. Tomcat reports the URL requested is 1048015 bytes. It was tested with Chrome 50 and Internet Explorer 11.

So web browsers won't truncate or limit your URL intentionally when sending Ajax requests.

Peter Mortensen
  • 28,342
  • 21
  • 95
  • 123
fuweichin
  • 733
  • 7
  • 8
  • 4
    The variation between Internet Explorer and IIS makes sense when you consider that not all requests to a web server are done via a browser. – TroySteven Jan 12 '18 at 16:39
15

Limit request line directive sets the maximum length of a URL. By default, it is set to 8190, which gives you a lot of room. However other servers and some browses, limit the length more.

Because all parameters are passed on the URL line, items that were in password of hidden fields will also be displayed in the URL of course. Neither mobile should be used for real security measures and should be considered cosmetic security at best.

Acey
  • 7,690
  • 4
  • 26
  • 46
11

It seems that Chrome at least has raised this limit. I pasted 20,000 characters into the bookmarklet and it took it.

wibberding
  • 685
  • 3
  • 9
  • 17
11

I have experience with SharePoint 2007, 2010 and there is a limit of the length URL you can create from the server side in this case SharePoint, so it depends mostly on, 1) the client (browser, version, and OS) and 2) the server technology, IIS, Apache, etc.

Peter Mortensen
  • 28,342
  • 21
  • 95
  • 123
Leonidas Menendez
  • 429
  • 11
  • 15
  • 1
    Because SharePoint exposes web URLs as file paths, it runs into a separate limitation: the Windows file path length limit of 260 characters (or 248 characters when using an API). For more details about this limit, check out the "Maximum Path Length Limitation" section here: https://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx – Thriggle May 20 '15 at 18:48
3

According to the HTTP spec, there is no limit to a URL's length. Keep your URLs under 2048 characters; this will ensure the URLs work in all clients & server configurations. Also, search engines like URLs to remain under approximately 2000 characters.

0

Check this answer: It has described all the browsers in details.

https://stackoverflow.com/a/812962/2568750

Yogi Ghorecha
  • 984
  • 14
  • 22
-4
Just remove or comment the following lines

public void ConfigureServices(IServiceCollection services) { /Identity/ services.AddDbContext(options => options.UseSqlServer(Configuration["ConnectionStrings:IdentityConnection"])); services.AddIdentity<AppUser, IdentityRole>().AddEntityFrameworkStores().AddDefaultTokenProviders(); /End/

        /*Identity Login Url */
        services.ConfigureApplicationCookie(opts => opts.LoginPath = "/Login");

        services.AddMvc();
        //Authorization
        //services.AddMvc(config =>
        //{
        //    var policy = new AuthorizationPolicyBuilder()
        //                    .RequireAuthenticatedUser()
        //                    .Build();
        //    config.Filters.Add(new AuthorizeFilter(policy));
        //});
    }
samer shalha
  • 1
  • 1
  • 1