Google Safe Browsing
Product brand
UnclaimedGoogle's service for identifying and warning against malicious websites and dangerous downloads.
Last updated August 22, 2026
Overview
Google Safe Browsing is a Google security service that helps protect people from phishing pages, malware-hosting websites, unwanted software, and other web-based threats. Its central function is the maintenance and distribution of threat intelligence concerning URLs and related online resources. When a supported browser, application, or Google product encounters a potentially dangerous destination or download, it can consult Safe Browsing data and display a warning before the user proceeds. The service began as Google's response to the growth of phishing and other deceptive online activity. Work started in 2005, initially focusing on anti-phishing protection and warning labels for suspicious pages appearing in Google Search. Google later made the technology available to third-party developers through a public API, first released in 2007. Safe Browsing became part of Google Chrome in 2008 and was subsequently integrated into Android and Google Play during 2011–2012. Safe Browsing operates as infrastructure used by a broad ecosystem rather than solely as a consumer-facing Google product. Chrome uses it for web and download warnings, while browsers including Firefox, Safari, Vivaldi, and Brave have also used the service to check destinations against known threat data. Google products can use the service to protect users, and Google provides APIs that allow external applications to perform URL safety checks. The service has also been used to notify website operators when their sites appear compromised and to alert autonomous-system operators about malicious content hosted on their networks. Its protection model has evolved over time. Early implementations could transmit complete URLs for checking, which raised concerns that Google might be able to observe users' browsing activity. Google subsequently introduced an Update API based on partial cryptographic hashes. In that model, a client sends abbreviated hash information rather than the complete URL, receives possible matches, and performs further local checking. Clients can cache responses to reduce repeated requests. Google has also offered an Oblivious HTTP form of its version 5 API, designed to separate the requester's IP address from the query content. Browser vendors have adopted different approaches to anonymizing or proxying requests. Safe Browsing has consequently occupied an important but contested position in web security. Its threat lists can reduce exposure to large-scale attacks, but false positives, infected advertising, website-remediation delays, and the concentration of web safety decisions in a small number of technology providers have attracted criticism. Privacy researchers have also examined whether request metadata could reveal browsing patterns, even when URL contents are obscured. Despite these debates, the service remains an active component of Google's browser and web-security ecosystem and a widely used source of malicious-URL intelligence.
History
Google Safe Browsing emerged from Google's work on anti-phishing protection in 2005. The early service focused on identifying deceptive websites and helping users recognize potentially dangerous destinations. One of its initial public-facing uses was the placement of warnings or labels alongside suspicious results in Google Search. This approach connected Google's search index with a growing body of security intelligence about phishing and malicious websites. In 2007, Google released an API that allowed external applications to query Safe Browsing data. This changed the service from an internal or primarily Google-facing protection mechanism into shared internet infrastructure. Developers could use the API to compare destinations with Google's threat information, enabling protection in products beyond Google's own search and browser properties. Google integrated Safe Browsing into Chrome in 2008. The browser could warn users before they opened known dangerous pages or downloaded files associated with malware and other unwanted software. The service later expanded into Android and Google Play during 2011–2012. Over time, other browsers, including Firefox, Safari, Vivaldi, and Brave, also used Safe Browsing checks, making the service influential across multiple browser ecosystems. The service's threat-intelligence role extends beyond end-user warnings. Google uses Safe Browsing information to alert webmasters when their sites appear to have been compromised. These notifications can help operators investigate malicious code, remove injected content, and request reconsideration after remediation. Google has also communicated threat information to internet-service and autonomous-system operators when dangerous resources are hosted on their networks. Privacy has been a recurring issue in Safe Browsing's development. Earlier implementations could require a browser to send a complete URL to Google for checking. Researchers argued that such requests could potentially create records of browsing activity, or at least expose sensitive information about users' destinations. A separate 2012 controversy concerned a third-party cookie associated with Safari's Safe Browsing integration, which researchers said could be visible to Google even when users had not visited Google websites. Other researchers compared the quality of protection supplied to different browsers and argued that Chrome received advantages not consistently available elsewhere. Google introduced a different Update API model in which clients send partial cryptographic hashes of URLs and receive possible matches from Safe Browsing databases. The client can then complete matching locally, while cached results reduce repeated requests. This design limits the information directly disclosed in an individual query, although request metadata such as IP addresses can still create privacy concerns. Later developments included support for Oblivious HTTP access to the version 5 API, intended to prevent Google from directly associating a request with the requesting IP address. Browser makers have adopted varying proxy and anonymization arrangements, including approaches used by Apple Safari and Brave. Safe Browsing has also faced criticism over false positives and remediation procedures. Legitimate sites have sometimes been flagged because malicious advertising or other third-party content on the site was compromised. Website operators may need to use Google Search Console and wait for a review before warnings are removed. More broadly, commentators have questioned whether centralized browser warnings could be used for censorship, although the cited historical material did not document a confirmed censorship case as of 2016. The service remains active as a layer of Google's broader security architecture. It combines maintained lists and APIs with browser, search, mobile, and download protections. Its reach has made it a significant source of web-threat intelligence, while its privacy, accuracy, and platform-governance characteristics continue to shape debate about centralized online safety systems.
- 2017
Reported reach exceeds three billion devices
[1]The service is reported to protect more than three billion internet devices as of September 2017.
- 2011
Expansion to Android and Google Play
[1]Safe Browsing protection expands into Google's Android and Google Play ecosystem during 2011–2012.
- 2008
Chrome integration
[1]Google Chrome begins using Safe Browsing to warn about dangerous websites and downloads.
- 2007
First public Safe Browsing API
[1]Google releases an API enabling third-party applications to use Safe Browsing threat data.
- 2005
Google starts Safe Browsing development
[1]Google begins work on anti-phishing software that later develops into Safe Browsing.
Products and positioning
A large-scale web safety and threat-intelligence service that supplies browsers, applications, website operators, and Google products with signals for detecting phishing, malware, and other dangerous online resources.
Security API · 2007
Safe Browsing API
The public API family allows applications and services to check web destinations against Google's threat intelligence. It supports integration into browsers and other software that needs to identify phishing, malware, and related dangerous resources.
Privacy-oriented security API
Safe Browsing Update API
The Update API uses partial cryptographic hash information rather than requiring the client to transmit every complete URL for routine checking. Clients can cache returned data and perform additional matching locally, reducing repeated disclosure of browsing destinations.
URL reputation API
Safe Browsing Lookup API
The Lookup API provides a mechanism for applications to submit URL information and determine whether a destination appears on Google's lists of dangerous resources. It is one of the service's interfaces for developers and external applications.
Consumer security feature · 2008
Browser and download warnings
Safe Browsing powers warnings shown before users visit known dangerous pages or download files associated with malware, phishing, or other unwanted software. Chrome uses the service directly, while other supported browsers have used it as part of their own safety systems.
Website security service
Website compromise notifications
Google uses Safe Browsing findings to notify webmasters when their sites appear to have been compromised. Operators can investigate the problem, remove malicious material, and seek review after remediation.
Controversies
2016
Concerns about false positives and censorship
Commentators raised concerns that legitimate websites could be blocked because of malicious advertising or compromised third-party content, and questioned whether centralized safety warnings could be used for censorship. The cited material did not document a confirmed censorship case by that point.
2012
Privacy and browser-equity criticism
Researchers criticized the possibility that earlier Safe Browsing implementations exposed complete URLs to Google and examined a Safari cookie associated with the service. A separate report argued that Chrome users could receive more effective Safe Browsing protection than Firefox and Safari users.
Brand decisions
2011
Extend protection to mobile and app ecosystemsStrategyBackground
Threats increasingly affected mobile browsing and downloaded applications.
Action taken
Google expanded Safe Browsing into Android and Google Play during 2011–2012.
Aftermath
Safe Browsing became part of protection across Google's web, browser, mobile, and application environments.
2008
Integrate Safe Browsing into ChromeProduct launchBackground
Google was developing its own browser and needed built-in protection against dangerous destinations and downloads.
Action taken
Chrome incorporated Safe Browsing checks and warnings.
Aftermath
The service became a visible part of Google's browser security model.
2007
Open Safe Browsing data through an APIProduct launchBackground
Threat detection was initially developed as Google's anti-phishing and search-warning capability.
Action taken
Google released the first Safe Browsing API for use by third-party applications.
Aftermath
Safe Browsing became shared security infrastructure used beyond Google's own products.
- Move toward partial-hash and privacy-preserving checksStrategy
Background
Earlier URL-checking methods generated concerns that browsing destinations could be exposed to Google.
Action taken
Google offered an Update API based on partial hashes and later provided Oblivious HTTP access for its version 5 API.
Aftermath
The newer approaches reduce direct URL disclosure and can limit the ability to associate requests with individual IP addresses, although privacy characteristics vary by client and proxy arrangement.
Recent events
- 2017
Safe Browsing reaches more than three billion internet devices[1]
Other
Google reports that Safe Browsing was being used by more than three billion internet-connected devices as of September 2017.
- 2011
Safe Browsing expands to Android and Google Play[1]
Product generation
Google extends Safe Browsing protection into Android and Google Play during the 2011–2012 period.
- 2008
Safe Browsing is integrated into Google Chrome[1]
Product launch
Chrome incorporates Safe Browsing checks to warn users about dangerous pages and downloads.
- 2007
Google releases the first Safe Browsing API[1]
Product launch
Google makes Safe Browsing threat data available through an API for third-party applications.
- 2005
Google begins developing Safe Browsing as anti-phishing protection[1]
Other
Google starts work on a service intended to identify phishing and other dangerous web destinations.
Sources2 sources
Cite this profile: Cite the canonical profile. /brand-wiki/google-safe-browsing · Editorial policy · How profiles are compiled