The one idea
A browser fetches pages from other computers and displays them. That is all it does.
The address bar is not decoration. It is the only reliable evidence of whose computer you are talking to. A page can be copied pixel for pixel. The address cannot be faked — only disguised.
The address at the top tells you whose website you are really on. The page itself can be a convincing copy of anything.
Read the domain immediately before the first single slash. That is the actual site. Everything before it can be anything the attacker wants.
The registrable domain is the rightmost labels before the path. Subdomains
are controlled by whoever owns the domain, so bank.example.com is
controlled by example.com, not by any bank.
How to read a URL
Take this address:
https://accounts.google.com/signin?hl=en
| Part | What it is | Does it matter? |
|---|---|---|
https:// | The connection is encrypted | Yes, but see the warning below |
accounts. | A subdomain, chosen by the site owner | Not for trust |
google.com | The real site | This is the part that matters |
/signin | The page within that site | No |
?hl=en | Settings passed to the page | No |
The rule: find the first single / after the https://. The domain is what
sits immediately to its left. Read it right to left.
Try this
Which of these is really Google?
https://accounts.google.com/signinhttps://google.com.account-verify.net/signinhttps://google-accounts.secure-login.info
Fixing a page that will not load
When a website will not open
1 of 5Read the actual error.
"Server not found" means the address may be wrong or the site is down. "This site can't be reached" often means your connection. A 404 means the site is fine but that page does not exist. These are different problems with different fixes, and the message tells you which one you have.
Profiles: the feature almost nobody uses
A browser profile is a completely separate browser: its own logins, history, bookmarks and extensions, in the same application.
You have a work Google account and a personal one, and you spend your life signing out and back in, or picking the wrong account and sharing a document from the wrong identity.
Two profiles ends this permanently. Work in one window, personal in another, both open, never crossing over. Chrome, Edge and Firefox all support this and nobody is ever told.
Your challenge
Level 3 · IndependentSet up a second browser profile and use it for one week for something distinct — work, study, or anything where you have a separate account.
At the end of the week, answer: how many times did you avoid signing in and out? How many times did you nearly do something under the wrong account?
Most people are surprised by both numbers.
What people usually get wrong
- Trusting the padlock. It means encrypted, not honest.
- Reading the start of a URL instead of the domain. Attackers count on this.
- Clicking a link in an email to log in. Type the address yourself, or use your own bookmark. Always, for anything financial.
- Installing extensions casually. An extension can usually read everything on every page you visit, including what you type.
- Keeping ninety tabs open. They consume memory and you cannot find anything. Bookmark what you actually want to return to.
- Assuming a slow browser is an old computer. It is often one extension or one runaway tab.
How someone experienced does it
Experienced people never click a link to reach anything sensitive. Banking, payroll, government portals — they type the address or use a saved bookmark. It costs three seconds and removes an entire category of attack.
They also keep few tabs. Not out of tidiness: an open tab is an unfinished decision, and thirty unfinished decisions is a heavy way to work.
And when something breaks, they check whether it is just them before doing anything else. It is the cheapest possible diagnostic and it halves the search space immediately.
What actually happens when you press Enter
- Your browser needs the numeric address of the domain, so it asks a directory service called DNS: "what is the IP address for google.com?"
- It opens a connection to that address and, for
https, negotiates encryption — checking that the site presents a valid certificate for that exact domain. - It requests the page. The server sends back HTML, which references CSS, JavaScript, images and fonts.
- The browser fetches all of those, often from several different servers, and assembles them into what you see.
This is worth knowing because it explains the failures. "Server not found" is step 1 failing. A certificate warning is step 2. A page that loads with no styling is step 4 partially failing — the HTML arrived, the CSS did not.
You do not need to memorise this. You need to know that "the internet is broken" is actually four different things that fail separately.
Prove it
Find a real phishing example — search for recent phishing examples from a security organisation, or check your own spam folder.
Write down the domain it actually points to, and the domain it is pretending to be. Do not click anything. Hovering over a link shows the destination in the corner of the window.
Keep learning this
Paste this into any AI assistant. It turns the assistant into a tutor that tests you instead of just answering you.
Act as an experienced practitioner who is good at teaching. I have just learned how browsers work and how to read a URL safely. Assume I am intelligent but relatively new to this — treat me as beginner level. Work through this in order, and wait for my reply at each step: 1. Ask me 5 questions that test whether I actually understood how browsers work and how to read a URL safely. Do not reveal the answers yet. 2. After I answer, tell me which parts I got right, which I got wrong, and which I only half-understand. Explain only what I misunderstood — do not re-teach what I already know. 3. Give me one practical challenge based on something I could genuinely encounter at work or in daily life. Do not solve it for me. 4. Evaluate my solution the way an experienced person would judge it, including what a professional would have done differently. 5. Tell me what to learn next, and why that comes next. 6. Give me trustworthy sources for deeper study — prefer official documentation, primary research or standards bodies over blogs and videos. Rules for you: no buzzwords. No motivational filler. Say "I'm not certain" when you are not certain, and tell me which parts of your answer I should verify myself. Clearly separate facts from your recommendations and your opinions.
Become independent at this
Use this when you want a path from where you are to actually good, with checkpoints you can test yourself against.
I want to become independently capable at using a browser confidently and safely — not permanently dependent on AI, tutorials or step-by-step guides. Design a progression for me with five stages: Beginner, Guided practice, Independent practice, Real-world application, Professional level. For each stage tell me: - what I must know - what I must be able to do without help - the mistakes people make at this stage - one practical challenge - one real project that would prove I reached this stage - one way I can test myself honestly Then tell me the signals that I am ready to move to the next stage, and the signals that I have skipped ahead too early. Keep the theory to the minimum I actually need. Focus on ability I can transfer to situations you and I have not discussed.