The Google Chrome Privacy Whitepaper has a part about Safe Browsing, which says (emphasis mine):

If you navigate to a URL that appears on the list, Chrome sends a partial URL fingerprint (the first 32 bits of a SHA-256 hash of the URL) to Google for verification that the URL is indeed dangerous. Chrome also sends a partial URL fingerprint when a site requests a potentially dangerous permission, so that Google can protect you if the site is malicious. Google cannot determine the actual URL from this information.

It seems to me that to be useful, the hash has to be compared against a list on Google's side, and for this to be useful they would have to visit this URL to check if it's actually malicious. From there, it seems easy to keep a mapping between partial hashes and full URLs.

Is it true that Google cannot determine the URL from this partial hash?

To be sure, I am talking about Safe Browsing and not the optional "Help improve Safe Browsing" that can be enabled in Chrome settings. I know that the latter can send plain URLs to Google.


You are right that in order to mark a hash as belonging to a malicious URL, Google needs to have visited that URL in the past and have decided that it was malicious.

It would be quite reasonable for them to keep the URLs they have labelled as malicious. Indeed if they have any sense, they will, because the more hashes they accumulate, the more URLs will turn out to have the same hash by accident. Suppose the hash list grew to have a million hashes. Then any URL at all would have a 1 in 4,000 chance of having a “malicious” hash. Either Google will have to re-scan the “malicious” sites from time to time or they will have to change to, say, a 40-bit hash. Either way they will need the original URL.

So for you, there are three possibilities.

  1. Your URL's 32-bit hash is not in Google's list. In that case Google knows nothing about what URL you visited.

    Or your URL's 32-bit hash is in Google's list. In that case Google can infer that your URL is equal to their malicious one.

  2. a. They may be right.

    b. They may be wrong, and your URL may be something quite different.

Google has no way (based on the description you quoted) of distinguishing between 2a and 2b.

But to summarise, Google can't know anything directly about your URL, but if (and only if) it appears, from checking the hash, to be malicious, they know which malicious URL they think it is.


... From there, it seems easy to keep a mapping between partial hashes and full URLs.

Your argumentation is basically that it would technically be possible to reconstruct the URL from the hash if Google cared to store not only the hashes of malicious URL but also the associated URL. One can not deny that this is possible but in the same way it is possible that Google throws the association to the real URL away since it is not needed to make the decision.

At the end, it boils down to what and whom you trust: If you think that everything which can be technically done by Google might also be technically done by them even though they claim otherwise, then you'd better don't use any Google products since these can be used to get intimate details about you. And this is not specific to Google but affects also your OS vendor, ISP (or alternatively VPN provider), social networks etc.

Note that I'm not implying that these vendors and service providers always tell the full truth and that you can blindly trust them - history has shown otherwise. I'm only saying that just because something can easily be technically done does not mean that it will be actually done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.