Search Google or Type a URL: What Chrome Actually Does

By Umar Abbas, Principal AI Architect, SoftBrixAI

Open a new tab in Google Chrome and the empty box says Search Google or type a URL. It reads like a menu with two items. It is not. It is a single text field that has to guess which of two entirely different operations you meant, and it makes that guess before you finish typing.

Most explanations of the phrase stop at “you can search or you can navigate.” That is true and it explains nothing. The interesting part is the guess itself. What does Chrome do with marketing? Why does it treat pie/ as a place to go? What leaves your machine while the dropdown is still filling? And why does that one small ambiguity produce a measurable share of the world’s DNS traffic? All of it is documented. This guide walks the documented version.

Key Takeaways

• Chrome’s address bar is one field, called the Omnibox. It sorts your text into a web address or a search query before it sends anything anywhere.
• Chromium’s own design docs state the rules. A single word defaults to search, with a background DNS lookup checking for a local host. Multiple words go to search unless the first is a registered keyword. Anything shaped like a URL is treated as one.
• That ambiguity has a real cost. Research on root server data traced roughly half of all DNS root traffic, about 60 billion queries a day, to Chromium’s intranet redirect probes.
• The two options are not equally safe. Typing a known address skips the results page, and the results page is where brand impersonation and lookalike domains live.
• Since February 2026 there is a third path. The address bar now opens an AI Mode prompt box, so one field routes to a site, a results page, or a generated answer.

What does “Search Google or type a URL” mean?

The sentence is placeholder text. It shows up when the address bar is empty. It is there to tell you the box takes two kinds of input: a web address that sends you straight to a site, or search terms that go to your default search engine.

Chrome calls that combined field the Omnibox. Older browsers gave you a separate address bar and a separate search box, and you had to know which one your input belonged in. Merging them took that choice away from the user and gave it to the browser. The placeholder is the browser being honest about what it now accepts.

This is more than a design detail, because so much of the web runs through this one control. StatCounter, measuring more than 3 billion monthly page views, put Chrome at 68.28 percent of worldwide browser use in July 2026. Safari held 16.47 percent and Microsoft Edge 5.36 percent (StatCounter Global Stats, 2026). Chrome’s own engineers call the address bar a feature “used literally billions of times every day” (Google, 2024). Mozilla Firefox, Safari, Microsoft Edge and Brave Browser all use the same merged field, so most of what follows applies to them too, even though each one guesses a little differently.

The phrase also confuses people. They see it after a browser reset, a new profile, or a changed homepage, and assume something broke or that malware changed a setting. It is default text. It means nothing except that the address bar is empty.

How does Chrome decide if your input is a URL or a search?

Chrome matches your input against a set of documented patterns. It does this the whole time you type, not once when you press Enter.

Chromium’s public design documentation for the Omnibox is clear about the main cases. Items that look like URLs are treated as URLs. Multiple words are read as a search “unless the first word matches one of the user’s keywords.” Single words are the truly ambiguous case. There the browser will “default to displaying web search results while doing a background DNS lookup to figure out if a local host exists.” You can override the guess. Adding a trailing slash to a single word forces Chrome to treat it as a place to go (The Chromium Projects).

Laid out against real input, the pattern is consistent:

What you type	How Chrome reads it	What happens
example.com	Domain name with a recognized suffix	Navigates to the site
https://example.com/pricing	Full web address with scheme and path	Navigates directly to that page
marketing	Single ambiguous word	Searches, while a background DNS lookup checks for a local host
marketing/	Single word with a trailing slash	Treated as a destination, not a query
pie/	URL fragment shape	Treated as a destination
best crm for agencies	Multiple words, no keyword match	Goes to your default search engine
@bookmarks invoice	Starter pack keyword plus terms	Scoped search inside your bookmarks
localhost:3000	Host and port	Navigates, which is why local development works

Two things follow for anyone who works on the web. First, a bare project name typed into the address bar is a search, not a request to your own machine. That is why developers add the slash or the port. Second, this is a heuristic, not a contract. It shifts between browser versions, and Firefox, Safari and Edge each settle the ambiguity a little differently.

The hidden cost of that ambiguity

The background DNS lookup in Chromium’s documentation is not free. Its total cost is one of the stranger facts about this feature.

The mechanism is called the intranet redirect detector. Some internet service providers intercept DNS answers for names that do not exist. Instead of the expected NXDOMAIN error, they return a page of their own ads. That would poison the single-word guess, because every made-up word would then look like a real host. So Chromium probes with random names it knows cannot exist. If those come back resolved, the network is intercepting, and the browser stops trusting DNS to settle the question.

Verisign research on root server data found these probes made up a remarkable share of queries reaching the DNS root. On May 13, 2020, 45.80 percent of total traffic matched the Chromium probe pattern. The study concluded that “half of the DNS root server traffic is very likely due to Chromium’s probes,” roughly 60 billion queries a day. The signature was easy to spot: names of 7 to 15 characters, letters only, with 51 percent of them seen fewer than four times in a 24 hour window (APNIC Blog, 2020). The dataset combined DNS-OARC “Day In The Life” collections from 2006 to 2018 with Verisign’s own root server measurements.

The lesson travels well past browsers. One field that accepts two incompatible input types makes a pleasant interface and an expensive engineering problem. Something downstream still has to settle the ambiguity, and at scale that becomes infrastructure load nobody budgeted for. The same tradeoff shows up constantly in AI agent development. One natural language entry point has to be routed to one of many tools, and the routing layer quietly turns into the most expensive part of the system.

What happens when you type a URL

Direct navigation feels instant. It takes at least four steps, and you see none of them.

Chrome completes the address. Typing example.com leaves out the scheme, so the browser adds one. That used to mean plain HTTP. It is exactly the gap an attacker on the network wants, because an unencrypted first request can be intercepted and redirected.

HSTS decides the scheme. HTTP Strict Transport Security lets a site tell browsers to always use encryption. A server sends a header such as Strict-Transport-Security: max-age=16070400; includeSubDomains. For that whole period the browser upgrades on its own, whether you typed http:// or left the scheme off. Fresh installs have never seen the header, so Chrome also ships an HSTS preload list of domains hardcoded as HTTPS only, and other browsers build on that same list. You can inspect what your browser holds at about://net-internals#hsts (The Chromium Projects).

The default is now moving past HSTS. Google has said HTTPS-First Mode turns on in Chrome 147 in April 2026 for the more than 1 billion users with Enhanced Safe Browsing enabled. It becomes the default for everyone in Chrome 154 in October 2026. The company puts HTTPS at 95 to 99 percent of main frame page loads depending on platform. Under the new default it measured that the median user sees fewer than one warning per week, and the ninety-fifth percentile user fewer than three (Google, 2025).

DNS resolves the domain name. The Domain Name System turns example.com into an Internet Protocol address. Your resolver may answer from cache, or the query walks up the hierarchy until something authoritative replies.

The request goes out and the page comes back. A connection opens to that IP address, TLS is negotiated, an HTTP request is sent, and the server returns content or a redirect.

None of this touches a search engine. That is the real difference between the two options, and it is the basis of every security argument for typing addresses directly.

What happens when you search instead

Search replaces navigation with two stages: predict, then rank.

While you type, Chrome asks your default search engine for suggestions. At the same time it pulls candidates from your own browsing history, bookmarks and open tabs. Google autocomplete predictions are only part of what fills that dropdown.

The ranking stopped being hand tuned in 2024. Chrome swapped its scoring formulas for machine learning models in M124, released in April 2024, because the old hand-built rules “were difficult to improve or to adapt to new scenarios.” The model then surfaced behavior the old formula never captured. When a URL had been visited only seconds earlier, the model lowered its score rather than raising it. A user who comes straight back to the Omnibox is usually fixing a mistake and does not want the same result again (Google, 2024).

That detail is worth sitting with. The address bar is not just matching strings against your history. It runs a learned relevance model over your behavior, and it carries assumptions about intent that nobody wrote down as a rule.

What Chrome sends to your search engine as you type

This part of the comparison is rarely stated precisely, and it is the strongest practical reason to pick one method over the other.

Google’s documentation on how Chrome handles URL and search data sets out the following:

• With “Improve search suggestions” enabled, what you type in the address bar “is sent, along with your IP address and search information stored on your computer as cookies” to your default search engine.
• If Google is your default engine and “Make searches and browsing better” is on, “the current URL of the page you’re viewing is sent to improve the relevance of these suggestions.”
• After you pick a suggestion, Chrome reports “information about the selected suggestion such as whether it was a search or a URL, how many characters you typed before you selected it and its position in the list of results.” That telemetry “doesn’t include exactly what you type or the URL you select.”
• Chrome suppresses transmission for sensitive input. When you enter “passwords, local filenames, or HTTPS URLs with paths, Chrome detects it” and “doesn’t send the entered text for autocomplete suggestions” (Google Chrome Help).

That last bullet is the one to remember. A full HTTPS address with a path often carries a session token or a document identifier, and Chrome deliberately holds it back from the suggestion request. Everything shorter it does not.

The practical point is simple. Text you type into the Omnibox counts as possible search input, and it can leave your machine before you press Enter. A complete HTTPS URL with a path is not sent for suggestions. If the difference matters to you, turn suggestions off in Chrome’s settings. The field then behaves as an address bar only.

Search Google or type a URL: which should you use?

Neither is universally better. The correct choice depends on whether you already know the destination and how much the destination matters.

Situation	Better option	Why
You know the exact web address	Type the URL	One request, no results page, no interception surface
Banking, payroll, admin panels, anything holding credentials	Type the URL, or use a bookmark	The results page is where impersonation lives
You know the brand but not the address	Search	Autocomplete and ranking resolve it faster than guessing domains
You want to compare options	Search	The entire value is in seeing multiple results
You need a specific page deep inside a large site	Search with site:	Faster than navigating a site’s own menus
A site you visit daily	Type the first few letters	History autocomplete completes it in two or three keystrokes
An address someone sent you in a message	Type it, do not click	Removes the link’s ability to point somewhere else

The security case for direct navigation is concrete, not theoretical. Zscaler ThreatLabz examined more than 30,000 lookalike domains aimed at over 500 of the most visited sites between February and July 2024, and found more than 10,000 of them malicious. Google was the most impersonated brand at 28.8 percent of instances, followed by Microsoft at 23.6 percent and Amazon at 22.3 percent. Encryption was no signal of safety: 48.4 percent of the malicious domains carried valid certificates (Zscaler ThreatLabz, 2024).

Both routes have an attack surface. Typing a URL exposes you to typosquatting when you mistype the domain name. Searching for a brand exposes you to whatever sits at the top of the Search Engine Results Pages, paid placements included. The difference is that a correctly typed or bookmarked address leaves no ambiguity to exploit, while a search always ends with a person picking from a list.

AI Mode made it three paths, not two

The two option framing became incomplete in 2026.

Chrome now puts AI Mode directly in the address bar. Google’s documentation describes it as breaking a question into subtopics, searching several of them at once, then returning an AI answer with follow up questions and supporting links. You trigger it with the AI Mode icon or by pressing Tab + Enter. To hide the button, right click the address bar and unselect “Always show AI Mode.” Google notes the feature “is not available to everyone or on every device at this time” and is still rolling out beyond the US and beyond English (Google Chrome Help).

The interface went further in February 2026. Chrome 145 for desktop expanded the address bar into a full prompt box with a plus menu for attaching recent tabs, images and files, plus tools and model selection. It replaced the earlier setup, a single button that forwarded your text to AI Mode (9to5Google, 2026).

Underneath, this is retrieval and synthesis, not a longer results page. It is the same pattern behind enterprise RAG systems: break the question up, retrieve against several sub-queries, then generate an answer grounded in what came back. One box now serves three destinations. It takes a place to go, a query, or a prompt, and the placeholder text has not caught up.

How to change your default search engine and add site search shortcuts

Two settings determine what the search half of the Omnibox actually does.

Changing the default search engine. Chrome’s search engine settings live at chrome://settings/searchEngines. Whatever is set there receives your text when Chrome reads it as a query. Switching to DuckDuckGo or another provider changes where suggestions come from as well as where results land. Firefox, Safari, Edge and Brave each keep the same setting in their own preferences.

Site search shortcuts. Chrome supports scoped searching with keywords. Type a registered keyword, press Tab, and the search runs inside that site rather than the whole web. Chrome also ships a starter pack reached with the @ prefix, including @history and @bookmarks, which narrow the query to your own data. Keywords that Chrome picks up from sites you visit start inactive, and you enable them in that same settings page (Chromium Docs).

Two search operators cover most of what people want from the search side:

• site:example.com pricing limits results to one domain, including its subpages. It is often faster than a site’s own search box.
• "exact phrase in quotes" demands the phrase word for word instead of a close match. Use it when you need a specific error string or an exact piece of wording.

What this means for how your site gets found

Every visitor arrives through one of these two doors, and from the site owner’s side they are not interchangeable either.

Someone typing your domain name has already decided. They know the brand, they remember the address, and no competitor sits between the keystroke and the page. That traffic is the payoff on brand recall and on a domain name short enough to type without thinking. It is also the traffic no ranking change can take away.

Someone searching has not decided. They land on a results page where your listing competes with organic rivals, paid placements, and now an AI generated summary that may answer the question without sending anyone anywhere. Search engine optimization is the work of being the answer in that setting: being indexed, being retrievable, and being written clearly enough that both a ranking system and a generative one can pull a correct statement off your page.

The point is that these two channels are built by different work, and neither replaces the other. Web indexing and content quality earn the search door. Memorable naming, steady brand presence, and a reason to come back earn the direct door. A brand strong enough to be typed directly is usually also a brand people search for by name, and defending your own branded Search Engine Results Page against impersonators is part of the same job. Teams weighing that split as part of a wider product decision are better off treating it as architecture than as marketing, which is how our AI consulting engagements tend to frame it. The same is true of the build itself, where AI software development choices about routing and retrieval decide what your pages can be found for later.

Frequently asked questions

Is “Search Google or type a URL” a virus?

No. It is Chrome’s default placeholder text in an empty address bar, and it appears on every standard install. If your browser also opens pages you did not ask for, redirects your searches, or shows a search engine you did not choose, that points to an unwanted extension or a hijacker, not to the placeholder. Check chrome://settings/searchEngines and your installed extensions.

Is typing a URL faster than searching?

For a site you already know, yes. Direct navigation is one request to one server. A search adds a round trip to a search engine and a results page you still have to read. In practice, history autocomplete cuts it to about three keystrokes. For any site whose address you do not know, searching is faster, because guessing domain names fails often.

How does the browser know I typed a web address and not a search?

It matches your text against known URL patterns. A recognized domain suffix, a scheme such as https://, a host and port, or a trailing slash all point to navigation. A single ordinary word defaults to search while the browser checks in the background for a host by that name on your network. Multiple words go to search unless the first word is a keyword you registered.

Is typing a URL safer than clicking a search result?

For destinations that matter, usually yes, on one condition: you have to type it correctly. Direct navigation skips the results page, which takes malicious paid placements and lookalike listings out of the path. It does not protect you if you mistype the domain. A bookmark removes both risks, which is why bookmarks are the better answer for banking and admin logins.

What does the browser send to Google while I type?

With search suggestions on, your text goes to your default search engine along with your IP address and cookies. Chrome does not send the text when it detects passwords, local filenames, or HTTPS URLs with paths. After you pick a suggestion, Chrome reports details about the choice, such as whether it was a search or a URL and how many characters you had typed, but not the text itself.

Can I make the address bar stop searching entirely?

You can get most of the way there. Turning off search suggestions in Chrome’s settings stops it from sending keystrokes to your search engine as you type, and the field then behaves much more like a plain address bar. Chrome has no setting that switches search off altogether, though enterprise policy and some Chromium forks give you more control.

How do I search inside one website from the address bar?

Use the site: operator, as in site:example.com annual report. Visiting a site’s own search once also tends to register a keyword in Chrome. Activate it in chrome://settings/searchEngines, then type the keyword followed by Tab.

Does AI Mode replace search in the address bar?

Not today. It sits beside the existing behavior as a third option, reached by the AI Mode icon or Tab + Enter, and Google has said the rollout is still expanding across regions and languages. Typing a URL still navigates. Typing a query still searches. You can hide the AI Mode button by right clicking the address bar.

Conclusion

“Search Google or type a URL” describes a decision the browser makes for you whether or not you think about it. A single word becomes a search and a background DNS probe. A trailing slash becomes a destination. Sensitive text is held back from suggestions, and ordinary text is not. Since February 2026 the same field can also send your words to a generated answer.

The useful takeaway is not that one option beats the other. It is that they do different things. One turns a name you already know into a connection. The other asks an outside system to decide what you probably meant. Knowing which one you just used, and when that difference carries a security or privacy cost, is the whole of it.

---

Umar Abbas is Principal AI Architect at SoftBrixAI, where he designs retrieval and routing systems for production AI applications.

Sources

1. StatCounter Global Stats, Browser Market Share Worldwide (July 2026)
2. The Chromium Projects, Omnibox design documentation
3. APNIC Blog, Chromium’s impact on root DNS traffic (2020)
4. The Chromium Projects, HTTP Strict Transport Security
5. Google, HTTPS by default (2025)
6. Google, How machine learning improved the Chrome address bar (2024)
7. Google Chrome Help, How Chrome keeps your URL and search data private
8. Google Chrome Help, Use AI Mode in Chrome
9. 9to5Google, Google brings full AI Mode prompt box to Chrome address bar (2026)
10. Zscaler ThreatLabz, Phishing, typosquatting and brand impersonation (2024)
11. Chromium Docs, Site Search in Omnibox explainer