Free tools Windows power users keep installed
One-click scans. No signup required.
“Browser-specific URL scheme” can mean two different things: a browser’s own internal address, such as chrome://, or a custom scheme such as myapp: that may be handed to an installed application. Neither is the same as a website registering to handle links such as mailto:. The right implementation depends on who owns the handler, where navigation starts, and which browsers and operating systems you need to support.
What is a URL scheme?
A URL scheme is the identifier before the colon in a URL. Examples include https:, mailto:, and browser-internal schemes. An HTML link can point to a non-HTTP URL, but that does not make its scheme a browser feature: the environment decides whether and how the link is dispatched. See MDN’s reference for the HTML anchor element.
![Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability](https://m.media-amazon.com/images/I/41H4YJnxKgL._SL160_.jpg)
People use “browser-specific URL scheme” loosely. It may refer to an internal browser address, or to a custom application scheme that happens to be opened from a browser. Those mechanisms have different owners, registration steps, and security implications.
Five mechanisms that are easy to confuse
| Mechanism | Who owns the handler | Where it is registered | What to expect |
|---|---|---|---|
| Browser-internal scheme | The browser | Defined by the browser | Opens browser-defined pages or behavior, such as an internal settings page. It is not an ordinary site protocol, and internal addresses are not portable across browsers. |
| Native-app custom scheme | An installed app and the operating system | Through application registration with the OS | A link such as myapp: may launch an app. Availability and which app receives it depend on the OS, installed apps, and user settings. |
| Website protocol handler | A website, through the browser | Page code calls navigator.registerProtocolHandler() |
Maps an eligible protocol to an HTTPS URL template. Browser support and user confirmation affect whether it can be used. |
| PWA protocol handler | An installed web app and the OS | A PWA manifest declares protocol_handlers; installation and OS association are involved |
Can associate a protocol with an installed web app. Availability, association, and launch behavior depend on browser and OS support. |
| Extension protocol handler | A browser extension | Extension manifest | Follows that browser’s extension permissions and user controls; it is not a general website capability. |
Register a website protocol handler
The Web API navigator.registerProtocolHandler() lets a website ask the browser to use an HTTPS page as a handler for a supported protocol. MDN marks the API as limited availability and requires a secure context, so implement it only as a progressive enhancement. The browser may ask the user to approve registration or activation. Consult MDN’s API reference for current browser details.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
Handler requirements
- The registering page must run in a secure context.
- The handler URL must use HTTPS, be on the same origin as the registering page, and include
%s. The browser substitutes the escaped URL being handled for that placeholder. - A custom scheme must start with
web+, contain at least one letter after that prefix, and use lowercase ASCII letters. Otherwise, it must be one of the schemes permitted by the API. - Registration is subject to browser support and user consent; a successful API call should not be treated as proof that every user has an active handler.
These constraints mean a website cannot use the API to claim any arbitrary scheme or route the original URL to an unrelated origin. Design the handler page to parse the substituted value carefully rather than treating it as trusted input.
Use a PWA manifest when the installed app should handle a protocol
A PWA can declare protocol_handlers in its web app manifest. Unlike a page-level protocol handler, this approach is associated with app installation and OS-level application preferences. MDN marks the manifest feature as experimental or limited availability; the handler URL must be HTTPS and within the app’s scope. See MDN’s PWA manifest reference.
Chromium’s PWA URL-handler documentation describes an association-validation mechanism, possible user choice when multiple apps match, and revalidation of associations. Its proposal targets navigations that originate outside the browser; it does not handle browser-tab navigations. The documentation says, “This is why the app association mechanism is an important part of the scheme.” That safeguard matters because a poorly implemented handler could hijack website traffic. See Chrome for Developers’ PWA URL handler documentation.
Extension handlers have their own permission model
Firefox WebExtensions can declare protocol_handlers in the extension manifest, including a protocol, a user-visible name, and a URI template containing %s. The documented custom-name conventions use web+ or ext+. A handler may prompt the user; extension handlers do not run in private browsing by default unless the user grants private-window access. These are Firefox extension rules, not cross-browser web-platform guarantees. Check MDN’s WebExtensions reference.
Why a scheme works in one browser but not another
There is no universal dispatch rule for every scheme. Results vary according to whether the scheme is browser-internal, registered by the OS, supported by a website API, declared by an installed PWA, or provided by an extension. The launch context also matters: a link opened in a browser tab may behave differently from a link launched by another application.
- Different browser: An internal address belongs to its defining browser. Web API, PWA, and extension support also varies by implementation and version.
- Different operating system or app state: A native scheme may have no installed handler, or the OS may have a different app association. PWA protocol registration depends on installation and OS support.
- Different user decision: A browser or OS may require consent or ask the user to choose a handler. A registration request is not a guarantee of automatic dispatch.
- Different launch source: Some handlers target links coming from outside the browser rather than navigation between browser tabs.
- Managed browser: Administrators can impose policy restrictions. As a Chrome Enterprise example—not a general browser rule—Chrome’s URL blocklist documentation supports custom-scheme patterns such as
scheme:*andscheme://*. See Chrome policy setup and the URL Blocklist filter format.
Choose and test the handler for your use case
Use a website handler for a web destination
Choose navigator.registerProtocolHandler() when the destination is a page on your site and the scheme and template meet the API’s constraints. Keep a normal HTTPS path available for users whose browser does not support the API or who decline the prompt.
Use a native scheme when an installed app must open
A custom application scheme is appropriate when your installed app is the intended destination and its OS registration is in place. Do not infer the receiving app from the scheme name alone; users or installed software may affect the association.
Use a PWA or extension declaration only within its scope
Choose a PWA manifest handler when the installed web app should participate in OS-level protocol handling, and an extension handler when the behavior belongs to a browser extension. Each has distinct support and consent rules; neither is interchangeable with a page API.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBest Value
- Used Book in Good Condition
Build a compatibility test matrix
- List each target browser and operating system, including version ranges that matter to your users.
- Test with the relevant handler installed and absent, and with no handler, one handler, and competing handlers where the platform allows them.
- Exercise user approval, rejection, changed defaults, and managed-browser policies.
- Test links initiated inside a browser and from external applications separately.
- Record whether the intended page or app opens, whether consent or selection appears, and how unsupported cases recover.
Security: treat the incoming URL as untrusted
Any URI delivered to a website handler, PWA, extension, or native app can contain attacker-controlled data. Parse it and validate the scheme and fields you actually support. Constrain redirects and permitted actions; never assume that a scheme name proves which application will receive the request.
For OAuth flows in native apps, use the guidance in IETF RFC 8252, OAuth 2.0 for Native Apps. Its recommendations concern native-app OAuth and external user agents; they should not be generalized to browser-internal URLs or every custom scheme.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
