What Happens When You Type a URL in the Browser
The full journey from pressing Enter to a rendered page: URL parsing, DNS, TCP, TLS, HTTP, and the browser's rendering work, with a runnable raw HTTP request to show what travels on the wire.
After you type a URL and press Enter, the browser resolves the host to an IP address with DNS, opens a TCP connection, runs a TLS handshake for HTTPS, sends an HTTP request and renders the response. Interviewers expect the latency cost: a fresh HTTPS visit pays a DNS lookup plus three round trips before the first byte of HTML.
When you type a URL and press Enter, the browser looks up the server's IP address through DNS, opens a TCP connection, sets up TLS encryption for HTTPS, sends an HTTP request, receives the response, and then parses the HTML, CSS and JavaScript to draw the page. Each step adds latency, which is why caching and connection reuse matter.
- A browser splits a URL such as https://example.com/learn?x=1 into scheme, host, port (443 by default for HTTPS, 80 for HTTP), path and query.
- The TCP handshake of SYN, SYN-ACK and ACK takes one round trip, so on a link with 80 ms RTT that is 80 ms before the first byte of the request is sent.
- A TLS 1.3 handshake needs one extra round trip on top of TCP, while TLS 1.2 needs two.
- On a fresh HTTPS visit, the time before the first byte of HTML is roughly one DNS lookup plus 1 RTT for TCP, 1 RTT for TLS 1.3 and 1 RTT for the request.
- The HTTP Host header lets one IP address serve many sites by naming the site requested.
- The browser parses HTML into the DOM and CSS into its own tree, combines them into a render tree, then runs layout and paint, and a normal script tag pauses HTML parsing.
01Step 0: the browser decides what you typed
The address bar first decides whether you typed a URL or a search. For https://example.com/learn?x=1 it splits the URL into scheme (https), host (example.com), port (443 by default for HTTPS, 80 for HTTP), path (/learn) and query (x=1).
Before any network traffic it checks what it already knows. Is there a fresh cached copy of the page? Is the site on the HSTS list, which means it must be fetched over HTTPS even if you typed http://? If the cache is fresh, the request may never leave your machine.
02Step 1: DNS turns the name into an IP address
TCP needs an IP address, not a name. The browser checks its own DNS cache, then asks the operating system, which checks its cache and the hosts file. If nobody knows, the OS sends a query to a recursive resolver, usually run by your ISP or a public service.
The resolver, if it has no cached answer, walks the hierarchy. It asks a root server which servers handle .com, asks a .com server which servers handle example.com, and asks that authoritative server for the address. Each answer carries a TTL, a time to live, saying how long it may be cached. That is why DNS changes can take time to spread.
A modern name usually returns both an IPv4 address (an A record) and an IPv6 address (an AAAA record). In code, the OS call is getaddrinfo, and Python exposes it as socket.getaddrinfo.
03Step 2: TCP opens a connection
The client sends SYN. The server replies SYN-ACK. The client sends ACK, and the connection is open. This takes one round trip time (RTT), the time for a packet to go to the server and back. On a link with 80 ms RTT that is 80 ms spent before the first byte of your request is sent.
This is the reason browsers reuse connections (HTTP keep-alive) and open several in parallel. HTTP/3 avoids it entirely by using QUIC, which runs over UDP and merges the transport and encryption handshakes.
04Step 3: TLS for HTTPS
For HTTPS the client and server run a TLS handshake on top of TCP. They agree on a version and cipher, the server proves its identity with a certificate, and both derive shared encryption keys. TLS 1.3 needs one extra round trip, TLS 1.2 needs two. The details are in the next topic, HTTPS and the TLS Handshake.
After this step, everything between the browser and the server is encrypted. Someone watching the network can see which IP address you connected to, usually the hostname (the TLS Server Name Indication is normally sent in clear text) and roughly how much data moved, but not the path or content of the page you asked for.
05Step 4: the HTTP request and response
An HTTP/1.1 request is just text. You can send one yourself with a raw socket. This starts a tiny local server and requests a page from it:
import socket, threading, http.server
class H(http.server.BaseHTTPRequestHandler):
def do_GET(self):
body = b'hello from the server'
self.send_response(200)
self.send_header('Content-Type', 'text/plain')
self.send_header('Content-Length', str(len(body)))
self.end_headers()
self.wfile.write(body)
def log_message(self, *a): pass
srv = http.server.HTTPServer(('127.0.0.1', 0), H)
threading.Thread(target=srv.serve_forever, daemon=True).start()
s = socket.create_connection(('127.0.0.1', srv.server_address[1]))
s.sendall(b'GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n')
data = b''
while chunk := s.recv(4096):
data += chunk
print(data.decode())The request is a request line (GET / HTTP/1.1), headers, and a blank line. The response comes back as a status line, headers and a body. In my run it was HTTP/1.0 200 OK (Python's built-in server answers in 1.0 by default), then Content-Type: text/plain and Content-Length: 21, a blank line, and the 21 bytes hello from the server.
The Host header matters: one IP address can serve many sites, and the header tells the server which one you want. Status codes group by first digit: 2xx success, 3xx redirect, 4xx client error, 5xx server error.
06Step 5: the browser builds the page
The browser parses the HTML into a tree (the DOM). As it finds links to stylesheets, scripts, images and fonts, it fetches them, often over the same connection. CSS is parsed into its own tree. The two combine into a render tree that knows what to draw. Then layout works out sizes and positions, and paint draws it.
Scripts can block this process. A normal <script> pauses HTML parsing while it downloads and runs, which is why you see defer and async attributes and scripts placed at the end of the body. Anything that changes the page after load, from JavaScript or CSS, can trigger layout and paint again.
This is also why one URL can lead to dozens of requests: every image, script and stylesheet repeats parts of this process.
07Where the time goes, and interview questions
On a fresh visit to an HTTPS site, the cost before the first byte of HTML is roughly one DNS lookup, plus 1 RTT for TCP, plus 1 RTT for TLS 1.3, plus 1 RTT for the request. Reduce any of them and the page feels faster. DNS caching removes the first. Keep-alive removes the next two on later requests. A CDN puts the server physically closer, which shrinks the RTT itself.
Q: What is the role of DNS?
A: It maps a hostname to an IP address through a hierarchy of resolvers and servers, with caching controlled by TTLs.
Q: Why is TCP's handshake three steps?
A: To confirm both sides can send and receive and to agree on initial sequence numbers.
Q: Difference between HTTP and HTTPS?
A: HTTPS is HTTP carried inside a TLS-encrypted connection, giving confidentiality, integrity and server authentication.
Q: What does the Host header do?
A: It lets one IP address serve many sites by naming the one requested.
Q: What changes with HTTP/3?
A: It runs over QUIC on UDP, combines connection and encryption setup, and avoids head-of-line blocking between streams.