.dev domain names

What .dev is

.dev is short for developer, or development. IANA classifies it as a generic top-level domain from ICANN's 2012 New gTLD Program: open, unsponsored, available to anyone. It is operated by Charleston Road Registry Inc., trading as Google Registry, the same operator that runs .app, with no change identified as of 2026. Google and Amazon both applied; Amazon withdrew in July 2014, leaving Google unopposed, in what ICANNWiki describes as following an assumed private deal. No price for .dev was ever made public, and any figure circulating for it is unverified. The string was delegated on 20 November 2014 and reached general availability in late February or on 1 March 2019 depending on the source, after a sunrise from 16 January and an Early Access Program from 19 February.

The most consequential fact about .dev is one that browsers enforce rather than the registry. The entire .dev top-level domain is on the HTTP Strict Transport Security preload list, usually shortened to HSTS preload: a list of names that browser vendors compile and ship hard-coded inside the browser binary, instructing the browser never to connect over plain HTTP. This is not a redirect. A browser given an http:// address on a .dev hostname does not send the request at all; it rewrites the address to https:// internally, before any traffic leaves the machine.

Google's own material puts it plainly: .dev is included on the HSTS preload list, making HTTPS required on all connections. A valid TLS certificate is therefore mandatory before a .dev site will load for anyone, and its absence is a hard failure rather than a dismissible warning. Google Registry imposes the same registrar disclosure obligation as for .app: the encrypted-by-default nature of the namespace must be disclosed conspicuously before purchase, separately from general terms of service.

Who can register .dev

Anyone. There is no proof of developer status to supply, no repository to link and no company to verify. Registration is open worldwide in real time, and because nothing is declared nothing can later be audited or revoked on eligibility grounds.

The limits that exist are technical. Labels run from 3 to 63 characters, so one- and two-character names are not generally available, and the namespace is ASCII-only. The HTTPS requirement is a condition of use rather than an eligibility rule: the registry does not check for a certificate, does not suspend names that lack one, and cannot grant an exception. The check happens in the browser, against every .dev name at once.

What .dev costs to own

.dev sits at a higher standard registry price point than most commodity new gTLDs, and is generally priced above .app at retail, positioned as a mid-premium developer namespace rather than a volume extension. That relative positioning is a market observation rather than a published figure.

First-year discounting is common at registrar level, with renewals reverting to standard registry-driven pricing, so a portfolio priced on promotional first years produces an unpleasant anniversary twelve months later. Premium tiers exist, and premium status generally recurs at renewal rather than being a one-time cost: the elevated tier applies every year and persists when the name transfers.

Google Registry publishes a per-TLD pricing policy for .dev, and no .dev registry increase surfaced in the January 2026 round of adjustments. Restoration from redemption costs substantially more than a renewal, and a certificate belongs in the cost model even though it is usually free, because the domain is not usable without one.

Registration terms, renewals, and transfers

.dev registers for one to ten years in whole-year increments, on the same Google Registry lifecycle as .app. Auto-renewal typically triggers thirty days before expiry, followed by a forty-day post-expiry grace period at the ordinary renewal rate and then a thirty-day redemption window in which only the original registrant can restore the name, at a fee well above a renewal.

Transfers use standard ICANN gTLD policy with no registry-specific mechanism: an authorization code, commonly called an EPP or auth code, from the losing registrar, and no transfer-prohibited status on the name. Sixty-day locks apply after initial registration, a prior transfer and a change of registrant, and a successful transfer adds one year. Because .dev tolerates no plain-HTTP fallback, sequence migrations so that a working certificate is in place before the DNS cutover; a gap between the two is an outage, not a degraded experience.

WHOIS, RDAP, and privacy

Since 28 January 2025, RDAP, the Registration Data Access Protocol, has been the definitive source of gTLD registration data, replacing the sunsetted port-43 WHOIS services. Public output is redacted under ICANN's Registration Data Policy, masking registrant contact details while leaving domain status, dates, name servers and sponsoring registrar visible.

Privacy and proxy services are permitted and widely offered by registrars, often bundled. The one restriction to plan around is that privacy cannot be enabled for ninety days after a domain has been approved through the trademark-claims process.

DNSSEC is supported and registrant-manageable through DS records. Internationalized domain names are not supported: .dev is ASCII-only, like every Google Registry extension.

Who .dev suits, and who should avoid it

.dev suits individual developers and their portfolios, open-source projects, developer tooling, API and documentation sites, engineering blogs, developer-relations properties, and technical personal branding, where firstnamelastname.dev is a well-established convention. For that audience the HTTPS mandate is a feature rather than a cost, because they already automate certificates. Google's own use of web.dev and chrome.dev is unusually strong dogfooding for a registry-operated string.

Avoid it if your audience is non-technical. The word dev is jargon, and to a lay consumer the extension reads as internal, unfinished, or as a staging environment they were not meant to see. Avoid it too if you need plain HTTP anywhere in the stack, if you need internationalized characters, if you cannot guarantee automated certificate renewal, or if your local-development toolchain still assumes .dev is a private suffix.

Common mistakes with .dev

These are specific to .dev in a way no generic domain advice covers.

• Still using .dev as a local development suffix. This has been broken in Chrome since December 2017 and in other browsers since. The correct choice is .test, which RFC 6761 reserves for the purpose. People still hit it in 2026, usually through an old tutorial or a stale project config.
• Pointing a registered .dev name at a plain-HTTP host and concluding the registration failed. It did not. The browser is refusing to speak HTTP to a preloaded name, and there is no bypass, no warning page and no click-through. The fix is a certificate, and it applies to subdomains too, so api.example.dev and docs.example.dev each need valid TLS in their own right.
• Assuming .dev communicates something useful to non-developers. To a general audience it carries no meaning, or worse, signals a site that is not finished. Test it on someone outside engineering before committing a customer-facing brand.

The suffix that was already in use before it existed

.dev is unusual among top-level domains in having a large, entrenched user base years before it was real. Long before delegation, developers used .dev as a made-up private suffix for local hostnames, wired up through /etc/hosts entries or a local resolver, so a project could be reached at myproject.dev on a laptop with no connection to the public internet. The convention spread through tooling; Laravel's Valet, among many other development environments, defaulted to it.

ICANN noticed. .dev was one of twenty-five strings deemed ineligible for the alternative path to delegation because of name-collision risk, requiring additional mitigation study before it could proceed. That was a direct consequence of how heavily it was already used as a fake TLD on private networks: an enormous volume of queries for nonexistent .dev hostnames leaked out to the public DNS every day, and delegating the string meant those queries would suddenly start receiving real answers. The extension's popularity as an imaginary TLD delayed its life as a real one.

The reckoning arrived with the browsers rather than the root zone. When Chrome 63 began rolling out on 7 December 2017 with .dev preloaded, those local environments broke at once. A developer typing myproject.dev no longer reached their local web server; the browser silently rewrote the address to HTTPS, the local server had no certificate, and the request failed. As Laravel News put it at the time, there was no workaround. The ecosystem migrated to .test, which RFC 6761 reserves for exactly this purpose alongside .localhost, .invalid and .example. Valet's fix was a one-line command, but the disruption was broad. Anyone still carrying a .dev local-development convention in 2026 is carrying a nine-year-old bug.

That episode is also the clearest illustration of how the mandate works. HSTS preloading is a browser-side list, not a registry enforcement mechanism. Browser vendors compile it and ship it hard-coded in the binary, which is why it took effect before any network request and why it applied to purely local hostnames the registry had never heard of. Because the entry covers the whole top-level domain, every .dev name is on the list from the moment it is registered, and subdomains inherit it. There is no opt-out, for anyone. A registrant cannot have a name removed from preload, and cannot serve a plain-HTTP version alongside the secure one for legacy clients.