Universal links vs deep links on iOS: the short answer is universal links.

Universal links vs deep links is less of a debate on iOS than it sounds: Apple calls custom URL schemes an acceptable form of deep linking, but strongly recommends universal links. The reasons are uniqueness, a web fallback and security.

Universal links vs deep links on iOS

Apple is direct about the weakness of schemes: a reverse-DNS identifier doesn't stop other apps registering the same scheme, and if several do, which app opens is undefined.

How universal links work

When someone installs your app, iOS checks a file on your web server that confirms your site lets your app open its URLs. Since iOS 14 and macOS 11, those requests go to an Apple-managed CDN rather than your server. Apple says the CDN requests the file within 24 hours, and devices check for updates about once a week after installation.

Setting up universal links

1. Create a file named apple-app-site-association (no extension) and serve it from https://example.com/.well-known/ over https with a valid certificate and no redirects.
2. List your app IDs and the URL patterns your app handles under applinks.
3. In Xcode, add the Associated Domains capability and an entry such as applinks:example.com. Each subdomain needs its own entry and file.
4. Handle the incoming NSUserActivity in your app and validate every parameter.

{
  "applinks": {
    "details": [{
      "appIDs": ["ABCDE12345.com.example.app"],
      "components": [{ "/": "/buy/*" }]
    }]
  }
}

Gotchas

• If someone is already on your site in Safari and taps a link to the same domain, iOS keeps them in Safari. Cross-domain taps open the app.
• Changes to the file aren't instant, because of the CDN caching above.
• Treat links as untrusted input: Apple warns they are an attack vector and should never delete data or expose sensitive information directly.

The Android equivalent is App Links with assetlinks.json; see deep link vs App Link. One https URL for web, iOS and Android also keeps your website as the page search engines and AI assistants can read.

Questions people ask

What is the difference between deep links and universal links?

On iOS, a deep link often means a custom URL scheme like myapp://, which any app can claim. A universal link is a normal https URL that your verified app opens, falling back to your website if the app isn't installed.

Does Apple still support custom URL schemes?

Yes. Apple calls them an acceptable form of deep linking but strongly recommends universal links.

Where does the apple-app-site-association file go?

In your site's .well-known directory, served over https with a valid certificate and no redirects, with no file extension.

Why aren't my universal links updating?

Since iOS 14, Apple's CDN fetches the file, requesting it within 24 hours, and devices check for updates about weekly after install.