On Hiding URLs in the Browser

This image is stolen directly from Allen Pike’s post because I don’t have time yet to make a proper one. It shows the same page URL as seen in the address bars of Firefox 29 and Chrome Canary 36.0.1951.

Two days ago news broke that Chrome was going to modify the address bar in the browser to hide a page’s URL. Web developers reacted pretty swiftly saying it’s a bad idea. The first one I saw was Allen Pike’s Burying the URL, and then a thread on Hacker News.

My first reaction is that this is a terrible idea, for all the points listed.

My second reaction is different.

I’m a web developer. I rely on seeing the URL every day not only as part of my job, but also to consume content and understand its value. I’ve been championing human-readable URLs for 20+ years and have railed against platforms that don’t use them. Non-human-readable URLs are still valuable to me, though probably not the typical user.

Whether I want to hack a URL to remove the tracking nonsense appended by buff.ly-style shorteners, posit the date of a blog post when the author hides publish dates, or make sure I am looking at the development version of a site I am building instead of the staging or production URL (which is hilarious to get wrong while trying to debug an issue), I see a lot of value in URLs.

I realize that many (most?) other users aren’t using URLs the way I do. Sure, I have trained my parents to look for certain things in a URL, but for the sites they frequent, which are often news sites with long strings of nonsense in the URL, there isn’t much value for them.

So besides web developers, is this really hurting the typical web user? Is our general outcry based on anything other than a variation on “looks great in my browser?”

I posted a tweet this morning that is getting some retweet action, but I’m not sure that people understand that I am framing the issue from my perspective, not the average user’s perspective. If anything, it belies how little I want to be family tech support. The tweet:

At the same time, Patrick Lauke was on his own tirade about how, as developers, we aren’t really typical users. A couple points from the stream:

URLs have been getting masked, obfuscated, or hidden for some time now. My mobile phone hides a URL as soon as I scroll down the page. My browser doesn’t show the HTTP protocol unless it’s HTTPS. Opera Coast has gone a step further as it appifies the web experience.

Opera Coast has hidden URLs all along (as I note in my review), and while I don’t know how that’s mattered to typical users, it was enough to make me stop using it. While it is possible to get to the URL within Opera Coast, it’s a bit more of a hassle than I like.

In the case of Chrome, it will be one click (which is one more click than I would like) to show the full URL as this video (embedded below) shared by Mark Harwood shows (sorry, only MP4 for now):

If the hidden URLs feature does make it into a coming release of Chrome, we as web developers can simply disable it with a Chrome flag: chrome://flags/#origin-chip-in-omnibox.

At this point, my resistance to the change is that I am a web developer who consumes URLs and that I don’t want to have to re-train my parents how to send a link (without using some nonsense “share” button). I’d rather not see URLs go away, but I’m a professional, I can sort it out.

Unrelated

App Links you say? Don’t get me started on App Links.

Update: May 4, 2014: Related

Jake Archibald has shared his opinion in his post Improving the URL bar. As is often the case in technical discussions, the comments have a lot of good back and forth.

Jeremy Keith has his own response post, the mispronounced-yet-whittily-named URLy warning.

Remy Sharp offers an alternative to the proposed URL hiding in hist post On Chrome hiding URLs to protect users from phishing. In short, he tries to tackle the stated reason behind Chrome’s desire to hide URLs without hiding URLs.

Not really related, but interesting nonetheless is this post, The Secret Messages Inside Chinese URLs. The post is really talking about domain names on their own, but in the context of the page-level URL discussion I think it’s novel.

Update: May 6, 2014

Opera 21 has come out, and among its release notes is this nugget on URLs in the address bar:

We now provide an option to make Opera persistently show a page’s complete URL in the address field.

[…]

For more technical users who need to quickly see the entire URL at a glance, go to “Settings | Advanced: Show always full URL in address field” to view all of that “important” information.

In addition, thanks to a re-start of the conversation on Twitter Jake Archibald has found a study that, while not exactly addressing the entire topic, does address it in part: Does Domain Highlighting Help People Identify Phishing Sites? The non-paywalled PDF file was found by Manu Sporny. Some notes:

Our research asks a basic question: how well does domain highlighting work? To answer this, we showed 22 participants 16 web pages typical of those targeted for phishing attacks, where participants had to determine the page’s legitimacy. […] We conclude that domain highlighting, while providing some benefit, cannot be relied upon as the sole method to prevent phishing attacks.

Now to change gears again, for those who claim that browsers have always shown the full URL, I present the following evidence that it’s not quite true: Lynx 2.8.1 (one of the browsers I used daily back in the old days, not as a novel testing tool).

A screen shot of Lynx 2.8.1 viewing a page at CNN with no visible URL, as well as no obvious way to display it.

Update: May 13, 2014

A couple more interesting reads have popped up. One is a more in-depth and sweeping discussion from Jeremy Keith that builds on his original post and equates the removal of relatively small features with the long-term removal of control from users: Seams

The other one I missed during my first update to this post. Nicholas Zakas argues that URLs are already dead.

Update: September 5, 2018

The Chrome team is picking this up again.

The Chrome team has been thinking about URL security for a long time. In 2014, it tried out a formatting feature called the “origin chip” […]. Within a few weeks of showing up in a Chrome pre-release, Google paused the origin chip rollout.

[…]

Porter Felt says the group will be more ready to talk publicly about its ideas this fall or in the spring. And the group notes that the goal isn’t to upend URLs haphazardly, but to enhance a vision that is already in place, given that entity identification is foundational to the overall security model of the web. […]

11 Comments

Reply

I don't think it's a developer issue. I think it's a web architecture issue. URLs are foundational architecture and probably the key reason the web has been able to be globally interoperable. Compare two website to two Flash applets. You can link the two websites but how hard is it to link the Flash applets if you didn't write one of them? There is no standard way.

The more we hide URLs, the less that less skilled developers will understand their architecture and use, and the more likely they will create more stateful and less interoperable experiences on the web. It'll be a long slow decline.

When I've seen web developers design sites using URL-first site architecture the sites are typically easy to navigate and easier to understand where you are in the site because doing so forces them to implement a logical site structure. When URLs are ignored in designing the site architecture, the sites are generally chaotic and very difficult to grok without very strong information scents in breadcrumbs and such. Wikipedia and Twitter as cases of the former, Microsoft.com, Facebook.com and LinkedIn.com as cases of the latter.

Hiding the URL takes us further down that slippery slope of non-interoperability. Like the pre-Internet days of client-server chaos.

In response to Mike Schinkel. Reply

I agree that building a site's architecture from human-readable page addresses (which contribute to human-readable URLs) often results in a better site structure (BBC makes that very case*). I say often because I regularly see examples of where that's not true.

However, most sites don't appear to be built by information architects, let alone maintained by them, so that ideal just doesn't seem to pan out very often.

Given that some of the most prominent sites on the web are powered by tools that generate query string messes, and users seem to get to content anyway, seeing URLs doesn't necessarily guarantee a better experience.

Frankly, I think the long, slow decline started quite some time ago. I think of how few true developers are pushing out web content (which is awesome and kind of the point of the web). Thanks to platforms like WordPress and other blogging tool, most (more than 60%?) of the web is already living in a flat, chronologically-organized structure with page addresses driven by very little thoughtful IA behind them.

As the web becomes more and more a medium for "mobile" devices (heck, embedded browsers on TVs and fridges), where URLs are already hidden often by their very length compared to a tiny screen, I think this is inevitable — even if not immediately.

As for your point with Flash, I think I am missing it. We still have the ability to view the page source to get the URL, which is how users would also have to get the URL for any other embedded content (images, inline PDFs, video, iframes, etc.).

* Responsive Design Begins With The URL: http://smashingmagazine.com/2014/05/02/responsive-design-begins-with-the-url/

In response to Mike Schinkel. Reply

"Given that some of the most prominent sites on the web are powered by tools that generate query string messes,… seeing URLs doesn't necessarily guarantee a better experience."

You are debating my points with anecdote here, which we humans often do instinctively, but I'm sure you are educated enough to know that anecdotes are not statistically accurate. It shouldn't be a surprise that anecdotes almost exclusively support the biases of the teller. :) So can we agree not to use anecdotal evidence to support our opinions in this debate?

Yes, a better architecture does not guarantee a better experience but it can improve the likelihood of a better experience. And yes, I am assuming URLs are a better architecture.

So let's look to Roy Fielding, a man whose PhD thesis on REST has probably gotten more attention than any other PhD thesis in modern history. He studied the web to determine why it was successful; I'll quote from an interview with Jon Udel in 2006 to which I'll summarize to say that the URL used in a human context is one of the key reasons the web has been a success:

"**Udell**: So was focusing down on a smaller set of verbs partly driven by the experience of having people starting to use the Web, and starting to experience what URLs could be in a human context as well as in a programmatic context?

**Fielding**: Well, that was really a combination of things. One that’s a fairly common paradigm: if you are trying to inter-operate with people you’ve never met, try to keep it as simple as possible. There’s also just inherent in the notion of using URIs to identify everything, which is of course really the basis of what the Web is, provides you with that frame of mind where you have a common resource, and you want to have a common resource interface."

"and users seem to get to content anyway,"

Yes, some users get to some content, but that statement is like saying that A/B testing is not needed for a landing page with traffic from paid Google AdWords because "people are seeing the landing pages." Yeah, but the fact that some are successful does not mean the conversion rates can't be improved by making things more effective.

A simple example is that when URLs are presented in broken form because of typos users can often fix the URLs and find the content of interest by editing the URL. Or at least I have often been able to "(and yes I know that my experience is an anecdote. And ironically I had to edit a URL to find the 2010 post from Twitter, mentioned below.)"

"Frankly, I think the long, slow decline started quite some time ago."

Agreed, although it has fortunately be somewhat cyclical. Twitter ""broke" "the web" with hash-bang URLs but fortunately discovered that using hash-bangs was in error. Still, many organizations haven't been as corrective with their architectural mistakes.

"I think of how few true developers are pushing out web content (which is awesome and kind of the point of the web)."

Agreed. (continued…)

In response to Mike Schinkel. Reply

"Thanks to platforms like WordPress…"

(…continued) But I think your choice of scapegoat, WordPress, is ironic. I spend my days implemented advanced WordPress functionality so I can say that I know WordPress pretty well and IMO WordPress has been one of the great saviors of the URL to date.

Prior to WordPress' rise we had systems like Microsoft IIS and ASP.NET and in the open source space Joomla that couldn't have given two shits about proper URL design. WordPress OTOH has formalized a URL structure that people who use WordPress can come to know and generally expect. Here is the URL structure for most URL sites "(although I know the post URLs can be shortened; blame the SEOs for that and not WordPress):"

/{year}/
/{year}/{month}/
/{year}/{month}/{day}/
/{year}/{month}/{day}/{postname}/
/tag/{tag}/
/category/{category}/
/{taxonomy_name}/{taxonomy}/
/{custom_post_type_name}/{postname}/
/{pagename}/
/{pagename}/{sub_pagename}/
/{pagename}/{sub_pagename}/…/{sub_pagename}/

There are more but that should suffice to give your readers the idea.

"As the web becomes more and more a medium for "mobile" devices (heck, embedded browsers on TVs and fridges),… I think this is inevitable — even if not immediately."

Don't confuse "inevitable" with "ideal" or even with "good". Link-bait headlines from sites like BuzzFeed and Upworthy appear to have become inevitable for online publications, but that does not mean that their content is better than yesteryear's quality investigative journalism that can't seem to get funded much anymore.

And the drastic divide between political parties is because extremists vote and the moderates don't "(as often)" seems inevitable, and the funding of politician's campaigns by lobbyists and the super wealthy interested in political favors seems inevitable, but I hope you'd never confuse either "inevitability" with an ideal state of affairs to be championed?

"As for your point with Flash, I think I am missing it. We still have the ability to view the page source to get the URL, which is how users would also have to get the URL for any other embedded content (images, inline PDFs, video, iframes, etc.)."

The point is that with URLs we have one standard way to link. With Flash, notsomuch.

But let's something different from Flash; Single Page (Javascript) Apps and parallax sites. Many SPAs are broken from the URL/back button perspective as are many parallax sites are broken.

Having worked in agencies that produce many of the larger corporate websites I know that "nice to have" but not essential features are usually ignored because it would cost more to develop and the non-technical clients simply don't understand enough to require they not be delivered broken. Moving away from the URL just mean more and more "broken" sites.

For example, EmberJS works very hard not to break URLs, but not all SPA frameworks take the same care and if URLs are hidden, framework developers who would prefer not to be bothered have just one more rationalization for creating a framework that does not participate on the using the technologies that made the web successful in the first place.

Yes, it would be a long slow decline into a balkanization of the web. Please don't give those who would hasten that decline more ability to rationalize their poor choices.

In response to Mike Schinkel. Reply

"looking at the Alexa top 500 sites suggests to me that my assertion (not anecdote) is accurate."

Can I presume that you didn't actually look at all 500, but instead a significant subset? If yes, then you are still cherry-picking to support your own conclusion.

"Beyond some initial pages with human-readable URLs, these sites (…) tells me that their success was not predicated on human-readable URLs."

I've never asserted sites with poor URLs cause sites to be unsuccessful. To clarify what I said explicitly (maybe elsewhere) is all other things being equal human-readable URLs can improve UX and usability, and in some cases help success.

"That does not suggest they need be human-readable"

Again, to be clear, I am making the assertion that the more hidden the URLs the less developers will strive to make them human-readable.

"I agree that more human-readable URLs may perform better in A/B testing for marketing purposes,…"

Hmm. I assume you mean SEO? I acknowledge that but that is not at all my interest. My interest is in UX and usability.

"but until then you and I are speculating."

Yes, we are.

"Average users just don't "hack" URLs, no matter how easy a good IA tries to make them hackable."

Not that I currently have statistically significant evidence to the contrary but what is your evidence that they do not?

Besides "Average users" continue to evolve, especially as digital natives start using computers and technical luddites die off. Plus there's just the additional time spent using and thus learning. In 1994 I was completely overwhelmed with the URL syntax. But not now.

Essentially those who say "Average users just don't "hack" URLs" to justify hiding URLs are consciously or sub-consciously contributing to make that statement a self-fulfilling prophecy.

"The average user didn't seem to care since the average user doesn't generally understand what an anchor is (that is an assertion, not an anecdote, for which I am not taking the time to track down anyone's thesis to support as it would just be selection bias anyway)."

Again, w/o evidence our assertions cancel each other out.

"These people, IME, generally do not design URLs."

Correct. Which is why it is so important that WordPress designed the URLs for them.

(continued…)

In response to Mike Schinkel. Reply

(…continued)

"Since you have focused on WordPress, I can tell you that I felt for years that its method of generating page URLs was poor."

I didn't say the developer's **control** was great, just that what's delivered does a reasonably good job of generating reasonable URLs vs. some other systems. As a matter of fact I proposed improvements on Trac 4 years ago, but to no end: https://core.trac.wordpress.org/ticket/12935

And two months ago I gave a talk at WordCamp Atlanta called "Hardcore URL Routing for WordPress": http://hardcorewp.com/2014/hardcore-url-routing-for-wordpress/ See the slides starting on page 50 if you want more control of URLs.

"As someone who has spent 20 years developing content management tools that explicitly generate human-readable URLs, I was thrilled WordPress finally reached feature parity on an item I felt should have just been built in."

Same to all that. Except in my case it's been 27 years. :)

"As it is, most WordCamps I attend (live or remotely) that even discuss page addresses do it only in the context of SEO, certainly not in the context of creating a better user experience when on a site."

I guess you didn't attend my talk. See above. :)

"I don't confuse "inevitable" with "good," but I do recognize when something may be on its way out and that my energy is better spent making for a good transition."

Somebody has to fight the good fight. Otherwise we are doomed to mediocrity. That's why I am commenting so much on this topic.

BTW, here is some of my prior "fighting" :)

http://mikeschinkel.com/blog/welldesignedurlsarebeautiful/ (circa 2005)
http://blog.welldesignedurls.org/ (2006-2008)

"In this case, I'd prefer to spend my time harassing framework (etc.) developers to make their tools more accessible to people with disabilities than kvetch over hiding confounding URLs, a problem that is already endemic to the web."

I'd agree for you that made sense. But by making this post which took away time from your harassing of framework (etc.) developers you are giving cover to those developer who would prefer not to be bothered by the URL. And to me that's the shame. FWIW.

P.S. I really hate blogger that doesn't let me format comments. Ugh!

In response to Mike Schinkel. Reply

You make a number of claims that I think warrant a response, though they don't directly address whether or not it's bad to hide URLs from end users. Let me dive in.

To your suggestion that I am using anecdotes, looking at the Alexa top 500 sites suggests to me that my assertion (not anecdote) is accurate. Beyond some initial pages with human-readable URLs, these sites (Google results, Facebook content, YouTube videos, Twitter tweets, Amazon product pages, etc) tells me that their success was not predicated on human-readable URLs.

The quote you have chosen from Fielding identifies URIs (not human-readable URLs) as key to the success of the web. I agree. Being able to address content across the web to facilitate linking was and is crucial. That does not, however, suggest that they need be human-readable (though that sometimes satisfies "simple"). Nor that the consumer of the content needs to be able to see it, but rather that the author of content should make it readily available.

I agree that more human-readable URLs may perform better in A/B testing for marketing purposes, but that is my bias in *favor* of. That doesn't mean continuing to display the entire page address to the user will result in better conversions. I would be interested in seeing true A/B testing on that, but until then you and I are speculating.

Your self-identified example of adjusting a URL to find a page on a site is in line with how I use the web, but does not conform to my experience in user testing. Average users just don't "hack" URLs, no matter how easy a good IA tries to make them hackable.

Your example with Twitter is something I railed against here and thankfully Twitter's own experience showed it was flawed, but not because of the URL itself, but implementation issues. The average user didn't seem to care since the average user doesn't generally understand what an anchor is (that is an assertion, not an anecdote, for which I am not taking the time to track down anyone's thesis to support as it would just be selection bias anyway).

I think you misunderstood me about WordPress. Let me try to rephrase: the web has provided greater access to non-technical, non-IA authors thanks to the ease-of-use granted by blogging platforms such as WordPress (the top of the pile, hence my reference). This is a good thing. This is really what the web is about – being a platform for all voices, not those who are technical or IAs. WordPress, et al, enable that.

These people, IME, generally do not design URLs.

Since you have focused on WordPress, I can tell you that I felt for years that its method of generating page URLs was poor. Only when WordPress allowed more control over page addresses (I forget specific versions, but I suspect you could cite them) was I comfortable recommending it as a platform. As someone who has spent 20 years developing content management tools that explicitly generate human-readable URLs, I was thrilled WordPress finally reached feature parity on an item I felt should have just been built in.

As it is, most WordCamps I attend (live or remotely) that even discuss page addresses do it only in the context of SEO, certainly not in the context of creating a better user experience when on a site.

I don't confuse "inevitable" with "good," but I do recognize when something may be on its way out and that my energy is better spent making for a good transition.

In this case, I'd prefer to spend my time harassing framework (etc.) developers to make their tools more accessible to people with disabilities than kvetch over hiding confounding URLs, a problem that is already endemic to the web.

In response to Mike Schinkel. Reply

"I was referring to cases where URLs are posted on billboards, TV commercials, print ads, and so on. Sadly, those human-readable URLs tend to redirect users to far less simple URLs."

Ah yes. Agreed.

"Conversely, "you can see one of my WordCamp talks where I very briefly mention human-readable URLs to a room of non-technical users (slides 31 and 33)."

Scanned. Good talk, on point.

"To try and wrap this up,"

Yes, lets.

"I believe we agree on the point that human-readable URLs are (or at least should be) a best practice and that many sites don't do it regardless. I think we also agree that the user comes first."

Yes, agreed.

"Where I disagree is that users get so much value from URLs that hiding them will hurt their ability to effectively use the web."

No, I actually don't disagree; I think I've not made my point clear. I believe you are correct the *currently* most users don't value URLs although I think many do.

But I also think the percentage that do could easily grow to be a majority over time, assuming URLs are not hidden. How long? Might not be for another 20 years, but the web's been around that long already so it's not that far away.

"Any assertion that hiding URLs make it harder for developers will not convince me at all"

Again, I think I miscommunicated. I don't think hiding URLs makes it harder for developers. On the contrary, I think unhiding them makes it (indirectly) harder on developers. It's easier to ignore URL design than to take them into consideration. It's a constraint, if you will.

Instead my assertion is that hiding URLs will by-nature make users less aware of and thus less likely to understand URLs. By analogy not teaching grammar in high school would result in fewer adults knowing correct grammar even though most would still be able to write and pretty much all of them would still be able to speak. Just not as properly as they could otherwise.

In response to Mike Schinkel. Reply

I looked at about 100 of the Alexa top sites, saw no overwhelming number of sites whose content was using human-readable URLs, and felt it did not invalidate my assertion. Had I cherry picked, I would have simply rattled off the ones I new supported my claim. If you think I am wrong about that breakdown, you are free to provide evidence to the contrary.

When I said human-readable URLs may perform better for marketing purposes, I wasn't referring to SEO. I would have said SEO. I was referring to cases where URLs are posted on billboards, TV commercials, print ads, and so on. Sadly, those human-readable URLs tend to redirect users to far less simple URLs.

My evidence that average users don't hack URLs is based on a couple decades of user groups, focus groups, training sessions, and technical conferences. Anecdotally, I also witness lack of this behavior when casually observing users (like my family, friends, etc.).

I did not see your talk from WordCamp Atlanta. I will check that out. Conversely, you can see one of my WordCamp talks where I very briefly mention human-readable URLs to a room of non-technical users (slides 31 and 33).

To try and wrap this up, I believe we agree on the point that human-readable URLs are (or at least should be) a best practice and that many sites don't do it regardless. I think we also agree that the user comes first.

Where I disagree is that users get so much value from URLs that hiding them will hurt their ability to effectively use the web.

Any assertion that hiding URLs make it harder for developers will not convince me at all, as I note at the end of my post.

I also think Blogger's commenting (among so very many other aspects of it as a platform) is crap.

Reply

"The more we hide URLs, the less that less skilled developers will understand their architecture and use, and the more likely they will create more stateful and less interoperable experiences on the web. It'll be a long slow decline."

Let us bemoan the fact that back in the old days, anybody who had a car also knew how to fix the engine if something broke…but now we've hidden away the complexity of the combustion engine, electronics, etc and only specialists can repair cars.

"When I've seen web developers design sites using URL-first site architecture the sites are typically easy to navigate and easier to understand where you are in the site because doing so forces them to implement a logical site structure."

You can have a perfectly structured site even if your URLs are a mess (often because your CMS is incapable of generating anything sensible). Conversely, I've seen horridly structured sites with clean URLs. These are two separate issues, and we should not confuse them or say that without one the other won't happen.

In response to Patrick H. Lauke. Reply

"Let us bemoan the fact that back in the old days, anybody who had a car also knew how to fix the engine if something broke…but now we've hidden away the complexity of the combustion engine, electronics, etc and only specialists can repair cars."

Ah, but your sarcastic analogy is faulty. In both the old days and the new days it was degreed professional engineers hired by companies that had huge amounts of capital that designed the cars that were built. Backyard mechanics have never built cars for the masses.

Yet from almost day one the equivalent of backyard mechanics for the web have built and continue to built websites. Anyone with enough money for a computer and an internet connection can build websites these days.

So while I agree with you that I prefer today's cars over the cars of yesteryears I don't see that the same level of expertise is used to develop on the web that is required to design mass-produced cars.

"You can have a perfectly structured site even if your URLs are a mess (often because your CMS is incapable of generating anything sensible). Conversely, I've seen horridly structured sites with clean URLs. These are two separate issues, and we should not confuse them or say that without one the other won't happen."

First, you use anecdotes in support of your debate; see my reply Adrian on that fallacious debate technique.

Second, you are correct, they are two separate issues. But they are highly correlated for tangible reasons; a web framework that concerns itself with site architecture **requires** the designers to think through URL structure whereas a web framework that punts on URL design is perfectly free to incoporate unintelligible URLs. And since a good URL design can mirror a good site architecture one of the main reasons to do URL design is to architect a site for UX and usability.

But working through proper URL design is a lot of work and requires tradeoffs that people who do not appreciate URL design can simple avoid and make their own job easier. So many will do it. And even more will do it if the URL is generally hidden.

So again, yes they are two separate issues just as automobiles and power source are two separate issues. But as long as we have a huge network of gasoline stations but few ways to recharge an electric car most people will opt for one with an internal combustion engine.

Leave a Reply to aroselli Cancel response

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>