Does a valid URL input guarantee an HTTPS web address?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Destination observations were measured separately in Chromium 156 using detached native controls and programmatic value assignment. Node reruns the actual homepage callback and reads the saved browser observations; it does not independently rerun the browser. No form was submitted. We make no detector-score or statistical-watermark removal claim.

The validity flag permits more than HTTPS

The observer assigns each string to an input whose type is url. The HTTPS reference and mailto reference both have typeMismatch false and valid true. The relative /guide reference has typeMismatch true. This directly answers a form-specific question: a passing native URL constraint is not a requirement that a value point to an HTTPS web page. The fixture performs no navigation and has no network request for any supplied address. The example.test host is a local test spelling, not an availability claim.

A retained marker need not cause a native mismatch

The interrupted hostname remains present in the input value and reports valid true in the recorded browser. After the homepage deletes U+200B, the ordinary example.test spelling also reports valid true. The same boolean therefore accompanies different strings. An application should inspect its actual accepted representation rather than infer that a valid field is free of every unwanted character. The test does not use a detector, a DNS lookup or a page fetch to decide whether an address is acceptable.

Separate the receiving control from a navigation policy

If a destination expects a particular scheme or host set, define and test that contract explicitly in addition to the native field constraint. A relative link may be meaningful in a document while failing this standalone input test; a mail address can pass this field without meeting a web-page-only policy. The earlier URL.canParse guide examines parser success and protocol selection. Here the new evidence belongs to the HTML input validity interface, with its retained value and typeMismatch field captured together.

Keep the measured boundary narrow

Every control was created detached and populated programmatically. There is no required attribute, custom pattern, user typing, actual form submission or server validation. The browser reproducer repeats those exact operations; the Node harness reruns only the saved homepage cleanup against recorded browser observations. These examples are synthetic rather than copied Claude replies. URL validity establishes neither destination reachability nor authorship, and it provides no evidence that a statistical text watermark was detected or removed.

Reproduce this test

For a fresh native-control measurement, save and open reproduce-browser.html in your browser. It embeds the exact fixture observer and saved homepage script, runs locally, and shows its user agent. For the Node cleanup rerun, save reproduce.cjs, tested-app.js and browser-observations.json in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs