Web push notifications in 2026: the complete guide

Web push is the highest-return channel most websites still don’t use. In 2026 the platform support is finally universal — including iOS — and the plumbing is stable enough to build without a third-party SDK if you want to. This guide walks the full pipeline.

How the pieces fit together

Push works with four moving parts: your server (signs and sends messages), a VAPID keypair (identifies your server to push endpoints), a service worker on the client (receives payloads), and the browser’s push service (Google FCM, Apple APNs, Mozilla autopush). You never talk to APNs or FCM directly — you POST to the endpoint the browser gives you.

Step 1 — Generate VAPID keys

npx web-push generate-vapid-keys

Store the private key server-side. Ship the public key to the client to include in the subscribe call.

Step 2 — Ask the user, at the right moment

Never prompt on page load. Chrome and Safari both hide the native prompt if the user has denied twice — you get two chances, forever. Ask after a clear intent signal: they saved an item, they subscribed to a topic, they finished onboarding.

Step 3 — Subscribe and store

const reg = await navigator.serviceWorker.ready;
const sub = await reg.pushManager.subscribe({
  userVisibleOnly: true,
  applicationServerKey: VAPID_PUBLIC_KEY,
});
await fetch('/api/push/subscribe', { method: 'POST', body: JSON.stringify(sub) });

Step 4 — Send from the server

Use the web-push npm package. It handles the VAPID JWT and payload encryption. Every push MUST be user-visible on Chrome — background-only pushes get your origin blocked after 3 quota violations.

iOS specifics

Web push works on iPhone and iPad from iOS 16.4, but only if the user has installed your site to the home screen first. That means push acquisition on iOS starts with install acquisition — the two are inseparable.

Delivery and retention benchmarks

• Opt-in rate: 5–15% of visitors on desktop; 20–40% on installed PWAs.
• Click-through: 4–8% on transactional; 1–3% on marketing.
• 30-day retention lift: 20–35% for installed + push-enabled users vs. cold visitors.

Where InstantPWA fits

InstantPWA ships push as a managed pipeline: VAPID handled, subscription storage, segmentation, scheduling and delivery reporting — you write the message, we handle the rest.