Secure by default
Google won .app in ICANN's 2012 round, put it in the root zone in 2015 and opened it to everyone in May 2018. Its standout feature is invisible: the entire TLD is on the HSTS preload list that ships with Chrome, Firefox, Safari and Edge. Browsers will only ever connect to a .app site over HTTPS, which shuts the door on a whole class of downgrade and snooping attacks.
In practice that just means you need a TLS certificate before launch — trivial with most hosts today. Google later applied the same approach to .dev and .page.
Good for
- Mobile and web apps
- Product landing pages and download links
- Developers who want security on by default
Watch out for
- Sites must be served over HTTPS — plain HTTP won't load in modern browsers
- Popular one-word names are often premium-priced
.app by the numbers
.app is a generic top-level domain (gTLD), aimed at tech & startups. Charleston Road Registry Inc. runs the registry under a contract with ICANN.
.app entered the DNS root zone on July 2, 2015, 11 years ago. It came out of ICANN's New gTLD Program, the 2012 application round that grew the root from 22 generic TLDs to well over a thousand.
Charleston Road Registry Inc. operates a large portfolio of 46 TLDs, including .ads, .android, .boo, .cal and .channel.
On the technical side, .app is served by 5 authoritative name servers, every one of them reachable over IPv6. It is also DNSSEC-signed: the root zone carries a DS record for .app, which lets validating resolvers check its answers cryptographically. Registration data is published over RDAP.
Same registry, other endings
45 other TLDs share this operator.
.app vs other endings
.app FAQ
Do .app domains require HTTPS?
Yes. The whole .app TLD is on the HSTS preload list built into major browsers, so they only connect over HTTPS. You need a valid TLS certificate before the site will load.
Who runs .app?
Google, through its registry subsidiary Charleston Road Registry (Google Registry).
What does .app mean?
.app is a generic top-level domain named for the word "app", and it's aimed at tech & startups. It doesn't belong to any country.
What is .app used for?
.app is mostly used for tech & startups. Like most gTLDs, it's a label of intent rather than a guarantee — check the site, not just the ending.
What country is .app?
None. .app is a generic top-level domain, so it isn't tied to any country.
Who owns the .app domain extension?
Charleston Road Registry Inc. operates .app as its registry, under a registry agreement with ICANN.
When was .app created?
.app was delegated to the DNS root zone on July 2, 2015.
Is .app a valid domain?
Yes. .app is an active top-level domain in the DNS root zone, delegated in 2015, so .app addresses work in every browser.
Can I buy a .app domain?
.app names are sold through ICANN-accredited registrars. Some gTLDs restrict who can register, so read Charleston Road Registry Inc.'s policy if you're unsure.
Is .app DNSSEC-signed?
Yes, the root zone holds a DS record for .app.
Sources
Data from IANA root zone version 2026102000. Last changed October 21, 2026. Spotted something wrong? Tell us.
