How Long Can a URL Be? Limits in Browsers, Servers, and Search
· 2 min read
"What's the maximum URL length?" has no single answer, because every system in the chain enforces its own limit. What matters is the smallest limit your URL must pass through. Here are the real numbers, from most permissive to most restrictive.
The specification: no limit
RFC 3986 imposes no maximum. The HTTP specs only advise servers to accept "reasonable" lengths and define status code 414 URI Too Long for when they don't. Everything beyond that is implementation policy.
Browsers: effectively unlimited, with one exception
Modern Chrome, Firefox, and Safari handle URLs into the megabytes — limits exist (Chrome's is around 2MB for display purposes) but you will never hit them with a real link. History remembers Internet Explorer's 2,083-character cap; IE is dead, but that number shaped a generation of "2,000 characters max" advice, and it survives in some corporate tooling that copied IE's behavior.
Servers and CDNs: 4KB–16KB, and they mean it
This is the limit that actually bites. Default request-line caps:
| System | Default limit |
|---|---|
| Apache | 8,190 bytes |
| Nginx | 4K–8K (large_client_header_buffers) |
| IIS | 4,096 characters (path) |
| Node.js | ~16KB total headers |
| Most CDNs / WAFs | 8KB–16KB |
Exceed these and you get a 414 or an outright connection reset. Long URLs typically come from state stuffed into query strings — filters, serialized forms, Base64 payloads — and when a URL approaches kilobytes, the design smell is that data belongs in a request body or server-side session, not the address.
The SEO limits: far smaller
Search infrastructure enforces tighter budgets:
- Sitemaps: the protocol caps
<loc>at 2,048 characters. Longer URLs can't be submitted properly. - Search result display: Google shows a breadcrumb-style URL and truncates around 60 visible characters of path. Beyond that, your carefully chosen words become an ellipsis.
- Practice: studies of ranking pages consistently find short URLs correlating with better performance — not because length is a strong ranking factor, but because short URLs are a proxy for clean architecture and get shared more.
Social and messaging: the invisible mangler
Platforms don't reject long URLs; they rewrap them. Link shorteners, tracking wrappers (lnkd.in, t.co), and email clients that hard-wrap plain text at 78 characters — the last one silently breaks any long URL pasted into a plain-text email, which is a classic source of "the link doesn't work" support tickets.
Practical budgets
Working numbers that keep a URL safe through every layer:
- Full URL: stay under 2,000 characters absolute worst case; under a few hundred for anything meant to be shared.
- Slug: under 60 characters, 3–5 words — the window that survives search-result truncation. The slug generator counts as you type and flags when a slug crosses the line, and the SERP preview shows the truncation visually.
- Query string: if it's longer than the path, ask whether that state belongs in the URL at all. Strip what's merely tracking baggage.
Long URLs rarely fail loudly. They fail at the edges — the corporate proxy, the plain-text email, the sitemap validator — which is exactly why a budget beats a limit.