Browser

Microsoft Internet Explorer 5 has a maximum Uniform Resource Locator (URL) length of 2,083 characters. Internet Explorer also has a maximum path length of 2,048 characters. This limit applies to both POST request and GET request URLs. Internet Explorer has a maximum URL of 1024 characters. See WinInet specifications for details on the maximum length of the individual elements.

If you are using the GET method, you are limited to a maximum of 2,048 characters, minus the number of characters in the actual path.

However, the POST method is not limited by the size of the URL for submitting name/value pairs. These pairs are transferred in the header and not in the URL.

Firefox stops displaying the URL after 65,536 characters in Windows Firefox 1.5.x. However, longer URLs will work. I stopped testing after 100,000 characters.

Safari supports at least 80,000 characters, I stopped testing after 80,000 characters.

Opera supports at least 190,000 characters. I stopped testing after 190,000 characters. Opera 9 for Windows continued to display a fully editable, copyable and paste-able URL in the location bar even at 190,000 characters.

RFC 2616, "Hypertext Transfer Protocol -- HTTP/1.1," does not specify any requirement for URL length.

Server

Apache; my early attempts to measure the maximum URL length in web browsers bumped into a server URL length limit of approximately 4,000 characters, after which Apache produces a "413 Entity Too Large" error. I used the current up to date Apache build found in Red Hat Enterprise Linux 4. The official Apache documentation only mentions an 8,192-byte limit on an individual field in a request.

IIS; The default limit is 16,384 characters (yes, Microsoft's web server accepts longer URLs than Microsoft's web browser). This is configurable.

Perl HTTP::Daemon (Server); Up to 8,000 bytes will work. Those constructing web application servers with Perl's HTTP::Daemon module will encounter a 16,384 byte limit on the combined size of all HTTP request headers. This does not include POST-method form data, file uploads, etc., but it does include the URL. In practice this resulted in a 413 error when a URL was significantly longer than 8,000 characters. This limitation can be easily removed. Look for all occurrences of 16x1024 in Daemon.pm and replace them with a larger value. Of course, this does increase your exposure to denial of service attacks.

RFC 2616, A server SHOULD return 414 (Request-URI Too Long) status if a URI is longer than the server can handle (see section 10.4.15).

Summary

The HTTP 1.1 specification is clear: there should be no limit on the length of a URL. However, it recommends caution when dealing with URL above 255 bytes, since older implementation might have problems.

I have read in the Java Servlet Programming book by Jason Hunter that the max length of URL's including query strings for Get requests is 240 characters.