Are .io domains safe? What they are and the risks

Sunday 26 July 2026•8 min read

A .io domain is safe to register and safe to use: it is an active country-code domain, open to anyone, and Google treats it as a generic domain, like a .com. Its real disadvantages are a renewal price close to four times that of a .com, and an unsettled question about the islands it belongs to, which nobody can answer yet but which would come with years of warning.

That is the whole answer in two sentences. The rest of this page shows where each part comes from, so you can decide for your own business.

What .io is, and who runs it

.io is the country code of the British Indian Ocean Territory, the Chagos Archipelago in the middle of the Indian Ocean. IANA, the body that keeps the internet's list of top-level domains, records .io as an active country-code top-level domain managed by Internet Computer Bureau Limited, with its registry website at nic.io.

You do not need any link to the islands to hold one. The registry's own site says "you are not required to live in British Indian Ocean Territory to register .io domains", and that names are "issued on a first come, first served basis".

Tech companies took to it because of the letters. In the registry's words, early adopters "started using .io domain as its abbreviation of a standard industry term 'input/output'", and .io has "become a staple in startup culture".

The Chagos question: what is actually known

This is the disadvantage people search for, so here it is in order, from primary sources.

The treaty is signed but not in force. On 22 May 2025 the UK and Mauritius signed an agreement whose first article reads: "Mauritius is sovereign over the Chagos Archipelago in its entirety, including Diego Garcia." The published treaty is marked "The Agreement is not in force". We searched its text for "internet" and "domain" and found nothing about .io.

It has stalled. The House of Commons Library, in a briefing published 8 October 2026, says "The treaty has not yet come into force, and ratification by the UK has been paused until an agreement can be reached between the US and the UK over the future of the US base on the island of Diego Garcia." The bill to put it into UK law "was not passed before prorogation of the 2025-2026 session of Parliament and so fell".

A change of country would not switch .io off overnight. Kim Davies, then ICANN's vice president for IANA services, set out the rules in a November 2024 post. Country domains follow a list called ISO 3166-1, and in November 2024 "'IO' persists in the ISO 3166-1 standard". If the code were ever removed, "a five-year time window will commence during which time usage of the domain will need to be phased out", and "That time window might be extended under certain circumstances."

No decision about .io has been announced. The same ICANN post says "much of the discussion about .io is simply speculation" and "It is not a foregone conclusion that a change in sovereignty will result in a change to the .io domain". The registry's homepage, read on 20 October 2026, says nothing about the Chagos agreement either way.

What is not decided, plainly: whether the treaty will ever take effect, whether the IO code would change if it did, and who would manage .io afterwards. Anyone who tells you a date for the end of .io is guessing.

Important

The practical risk is a forced move, not a sudden outage. If the code were retired, ICANN's policy gives five years to move, possibly more. That is enough time, but a move still costs you redirects, new email addresses and reprinted material. Weigh it as a cost you might one day pay, not as a threat to your site next month.

Why .io costs more

Neither the registry's site nor the registrars we checked say why .io costs more, so we can only show you what it costs. These are the prices two registrars showed on 20 October 2026, for one year of a standard (not premium) name:

Registrar	First year	Renews at
Name.com	$79.53 (sale)	$117.83
Dynadot	US$28.89 (sale)	US$53.50

Name.com showed Australian dollars to an Australian visitor; Dynadot showed US dollars.

For comparison, Name.com showed a .com renewing at $29.45 the same day (rising to $31.45 on 31 October 2026). So at today's prices a .io renews at close to four times the price of a .com, and you pay that every year you hold it.

The first-year price is the one on the banner. The renewal is the one you live with. Over ten years at Name.com's current renewal price, a .io comes to roughly $1,180, against about $315 for a .com at its new $31.45. Prices change, so check the renewal line at checkout, not the headline.

How Google treats a .io address

Google says so directly. Its guidance on multi-regional sites says: "Google treats some ccTLDs (such as .tv and .me) as gTLDs, as we've found that users and website owners frequently see these more generic than country-targeted." .io is on the list that follows.

In plain terms, Google reads a .io site as it reads a .com: open to the world, tied to no country. Google says these endings "aren't associated with specific locations", so the ending itself gives Google no hint that you serve Australians. A site that wants to reach one country has to say so in other ways.

Who uses .io, and is it trusted

Mostly technology. The registry says people "associate .io websites with the latest and greatest technology and software brands". GitHub, for one, hosts its users' sites on its own "github.io domain", so .io addresses are familiar to many developers.

Whether it is trusted depends on who is looking. To a developer, a .io looks normal and maybe a little sharp. To a plumber's customer in Ballarat, it may look like a typo for .com, or like nothing at all. The extension does not earn trust for you; it borrows whatever your audience already associates with it.

Are .io websites safe to visit

The ending of an address does not make a site safe or unsafe. A .io site can be run by a careful company or by a scammer, exactly like a .com. When you are unsure of any site, check the full address letter by letter, be wary of links sent to you out of the blue, and never type a password into a page you reached from an email. That advice is the same whatever the last two letters are.

If your customers are in Australia

For a business that sells to Australians, .com.au is usually the stronger choice. Google's same guidance says a country code like .de gives "a strong signal to both users and search engines that your site is explicitly intended for a certain country". A .io gives no such signal.

.com.au has rules, which is part of why people trust it. auDA, which runs .au, says com.au names "are for businesses with a connection to Australia", that "The most common way to qualify is by having an active ABN or ACN", and that the name must connect to your business, for example your business name or an acronym of it.

A .io makes sense when your product is software, your buyers are technical, and they are spread across countries. If you are a Sydney startup selling a developer tool worldwide, a .io is a reasonable home. If you are a Sydney accountant, it will mostly confuse people.

A checklist before you register a .io

Your customers are technical, and a .io will look normal to them.

You have seen the renewal price, not just the first-year sale price, and you are happy to pay it every year.

You also hold, or can buy, the .com and (if you trade in Australia) the .com.au, so nobody else takes them.

Your email lives on the same domain, so you have thought about what moving would cost if you ever had to.

You have read the latest from ICANN and the UK Parliament yourself, rather than a headline about .io "disappearing".

If you trade in Australia, you have checked whether the .com.au of your name is free or for sale.

If you would rather buy a .io someone already holds than start from scratch, a handful are listed on Dotto, each with its asking price.