What happens when you open a web page

With a 50 ms round trip, an HTTPS page needs at least 4 round trips, 200 ms, before the first byte of HTML arrives. HTTP/3 cuts one.

Seven forty in the morning. A student on a crowded train taps a link to the school lunch menu on mobile data, and a moment later today's menu appears. (This is a made-up scene.) In that moment the phone did everything from the last five units: a DNS lookup, a TCP connection, an encrypted session, and an HTTP request answered with a status code. Follow the phone through it and count the waits.

First the phone reads the link

Say the link is https://www.example.com/index.html. MDN breaks a URL into parts. https is the scheme: use HTTP over an encrypted TLS connection, on port 443 unless another port is written. www.example.com is the host, the name DNS will turn into an address. /index.html is the path, the resource asked for on that server. A URL can also carry a query after a question mark and a fragment after a hash sign. The fragment points to a spot inside the page and is never sent to the server.

Four round trips before the first byte

The time for a message to reach the server and for the reply to come back is the round-trip time (RTT). Count the round trips and you can see where the wait comes from. One: if the name is not cached, the DNS lookup costs about one round trip to the resolver. Two: the TCP handshake, SYN out and SYN-ACK back. Three: TLS 1.3 (RFC 8446) agrees on keys in one round trip, and the client's last handshake message can travel with the HTTP request. Four: the request goes out and the response comes back. With a 50 ms RTT, that is 200 ms before the first byte of the menu, even if the server answers instantly.

HTTP/3 (RFC 9114) runs on QUIC (RFC 9000) instead of TCP. QUIC sits on UDP and sets up the connection and the TLS keys together, so the separate TCP round trip disappears: DNS, one handshake round trip, then the request, three in all. Plain HTTP on port 80 skips TLS and also needs three, but then anyone on the path, such as whoever runs a café's Wi-Fi, can read or change the page. The padlock in the address bar means the connection to that domain is encrypted. It does not mean the site itself is honest.

The menu arrives with a number in front

The reply starts with a three-digit status code. RFC 9110 groups codes by their first digit: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. The ones you will meet most are 200 OK, 301 Moved Permanently (the page has a new address), 404 Not Found and 500 Internal Server Error. If the school had moved the menu page, the phone would first get a 301 and then ask again at the new address. A 404 means the server answered and had nothing at that path, so the network itself was working.

One page, many files

The HTML is rarely the whole page. Say it mentions a style sheet, a script and five images. If the phone opened a new connection for each, every file would pay the TCP and TLS round trips again. Instead the browser keeps the connection open and sends the next requests on it, and with HTTP/2 and HTTP/3 several requests travel on one connection at the same time. Browsers also keep their own cache. When a response says it may be reused for a while, the next visit loads that file from storage without sending any request. Only when the files are in does the browser lay out and paint what you see. That is why the menu page the student opens every morning appears faster than a site opened for the first time, even on the same network.