.app and .dev Domains: The HTTPS Catch

An app domain on a .app or .dev extension is a top-level domain (TLD) operated by Google Registry, and its defining trait is that HTTPS is mandatory. Both TLDs ship on the browser HSTS preload list, so there is no plain-HTTP version of the site — a visitor's browser refuses to connect until you have a valid TLS certificate in place. That is the catch, and for most builders it is a good one.

Expect to pay roughly $15–20 per year, a few dollars above a $10–12 .com. In exchange you get an instant "this is software" signal and encryption you cannot forget to turn on. Below is who these extensions actually suit, why the forced HTTPS is a feature rather than a bug, and how the trade against a familiar .com really shakes out.

What Is an App Domain, and Where's the Catch?

.app launched in 2018 and .dev opened to the public in 2019, both run by Google Registry. They read cleanly to anyone technical: a URL ending in .app says "product," and .dev says "tools, docs, or a developer's personal space." There is no ambiguity the way a .co gets mistaken for a .com.

The catch is baked into the browser, not the DNS. Google submitted both TLDs to the HSTS preload list — a hard-coded roster of domains that Chrome, Firefox, Safari, and Edge will only ever load over HTTPS. There is no HTTP fallback to redirect from, because the browser never sends an insecure request in the first place. Register a .app name, point it at a server with no certificate, and visitors see a security error, not your homepage.

Why Forced HTTPS Is a Feature, Not a Bug

Preload-level HTTPS closes an attack that ordinary redirects leave open. A normal site that redirects HTTP to HTTPS still exposes that first insecure request, which an attacker on shared Wi-Fi can intercept before the redirect fires — the classic SSL-stripping downgrade. On a preloaded TLD that first request is never insecure, so the whole class of downgrade attacks disappears.

The cost is planning. You cannot spin up a quick HTTP staging box and add a certificate later; the certificate has to exist before anyone, including you, can view the site. In practice this is a solved problem:

• Free automated certificates from Let's Encrypt or your host, renewed automatically
• Managed TLS from platforms like Vercel, Netlify, Cloudflare Pages, or Firebase Hosting
• A reverse proxy such as Caddy that provisions and renews certificates for you

Set auto-renewal once and the mandate becomes invisible. Forget it, though, and an expired certificate takes the site fully offline — there is no degraded HTTP mode to fall back to.

Who Should Register an App Domain

An app domain earns its small premium when the extension itself does marketing work. Strong fits include:

• SaaS and web apps — the name plus .app tells a first-time visitor what they are looking at
• Mobile app landing pages — a natural home for App Store and Play Store links
• Developer tools, CLIs, and APIs — .dev signals the audience instantly
• Documentation and status pages — docs.yourtool.dev reads as purpose-built
• Personal portfolios for engineers — a .dev site is a quiet credential in itself

It is a weaker fit for a local service business, a store aimed at non-technical shoppers, or any brand that will be read aloud on radio or spelled out over the phone — those audiences default to .com and may not trust or remember anything else.

App Domain Pricing vs. the Trust of a .com

The money gap is small. A .app or .dev runs about $15–20 a year at most registrars, while .com sits at $10–12 (with a Verisign wholesale increase expected in late 2026). Neither is expensive; the real comparison is recognition, not price.

.com carries default trust earned over decades and roughly 80% of all domain aftermarket sales volume — people assume it, type it, and resell it. An app domain trades some of that universal familiarity for precision and, on the security side, guaranteed HTTPS.

Search ranking is not the tie-breaker some assume. Google's John Mueller has stated repeatedly that new generic TLDs are treated the same as legacy ones for ranking; a .app site is not handicapped versus a .com. (Country-code TLDs like .io or .co are different — they can carry a geographic signal.) So the decision comes down to audience: a technical crowd reads an app domain as modern and intentional, while a mainstream consumer audience still reaches for .com first. Many teams register the .com defensively and build on the .app.

Where to Buy — and Where to Find a Premium Name

For a standard registration, the registrar matters mostly for renewal price and privacy defaults:

• Porkbun — around $11 on many TLDs, free WHOIS privacy, strong all-round choice
• Cloudflare — at-cost pricing near $10.46, though it forces you onto Cloudflare DNS
• Spaceship — roughly $9.98 and rising in popularity
• Namecheap — cheap first-year promos (about $5.98) that renew near $13.98–18.48

Watch renewal traps: GoDaddy renewals land around $21.99, so a low intro price is not the real cost. Always compare year-two pricing, not the sticker.

If you want a premium, already-brandable app domain rather than whatever raw string is free, start with a curated marketplace. Atom.com (an aftermarket partner of DominantBrand) lists hand-vetted brandable names and ships each with a free AI valuation, a USPTO trademark screen, secure escrow, and a designed logo included with the listing — useful when you are naming a product, not just parking a URL. Broader aftermarket options include Afternic, Sedo, and Dan; feature Atom first for brandable quality, and use the others to widen the search. Across the aftermarket, typical sales land around $2,000–3,000 and good names can take 3–18 months to move, so budget time as well as money.

Locking Down Your App Domain

Because an app domain lives or dies by its certificate and DNS, harden the account that controls both:

• Turn on authenticator-app 2FA, not SMS, which is vulnerable to SIM-swap attacks
• Enable the registrar lock to block unauthorized transfers
• Add DNSSEC to protect against DNS spoofing
• Use a recovery email on a different domain, so a problem with this name cannot lock you out of your own account

Two operational notes: a newly registered or transferred domain carries a 60-day transfer lock, so plan moves ahead of launches. And since there is no HTTP fallback, treat certificate auto-renewal as production infrastructure — monitor it, because an expired certificate is a full outage on these TLDs, not a warning banner.

Frequently asked questions

Do I need an SSL certificate before launching a .app or .dev site?

Yes. Both TLDs are on the browser HSTS preload list, so browsers only load them over HTTPS. Without a valid TLS certificate the site will not display at all — there is no HTTP version to fall back to. Free automated certificates from Let's Encrypt or a managed host solve this.

Are .app and .dev domains bad for SEO compared to .com?

No. Google's John Mueller has confirmed that new generic TLDs rank the same as legacy ones. An app domain is not penalized versus a .com; the difference is audience familiarity, not search ranking. Country-code TLDs are the exception, as they can carry a geographic signal.

How much does an app domain cost per year?

Roughly $15–20 annually at most registrars, a few dollars above a $10–12 .com. Check the renewal price rather than the first-year promo, since some registrars advertise a cheap first year and renew much higher.

Can I run a plain HTTP version of a .app site for testing?

No. Even local and staging use over these TLDs is forced to HTTPS by the preload list. You will need a valid certificate for any environment, though tools like Caddy or a managed platform can provision one automatically.

Where can I buy a premium, brandable app domain?

For a curated, brandable name, start with a marketplace like Atom.com, which includes a free AI appraisal, a USPTO trademark check, secure escrow, and a designed logo with each listing. Afternic, Sedo, and Dan are additional aftermarket options. For standard registrations, Porkbun, Cloudflare, and Spaceship offer good pricing.