HTTPS Explained: Why That Padlock Matters

Q: What is HTTPS and how does it work?

HTTPS (HyperText Transfer Protocol Secure) encrypts the data flowing between your browser and the website by wrapping HTTP in a layer of TLS (Transport Layer Security) encryption. Even if someone intercepts the data, they see encrypted garbage instead of your information.

Q: What is the difference between HTTP and HTTPS?

HTTP sends everything in cleartext, so passwords, credit cards, and messages are readable by anyone intercepting the traffic. HTTPS adds a layer of TLS encryption on top, so intercepted data is unreadable.

Q: What does an SSL/TLS certificate do?

During the TLS handshake, the server presents its SSL/TLS certificate to prove its identity. Certificates are issued by Certificate Authorities that verify the holder controls the domain. A certificate only proves the connection is encrypted, not that the site is trustworthy, since phishing sites use HTTPS too.

Q: Does the padlock mean a website is safe?

No. A padlock only means the connection is encrypted, not that the site is trustworthy. Free certificates made HTTPS accessible to everyone, including phishing sites, which use HTTPS as well. Always judge the site itself, not just the padlock.

Q: What does HTTPS not protect?

HTTPS does not hide which websites you visit, since your ISP and DNS provider can still see the domain names. It also does not protect data stored on the server, prevent tracking, or stop browser fingerprinting.

~/sheets/https-explained.md

That Padlock Is Doing More Than You Think
You see the padlock icon in your browser address bar every day. But do you know what it actually means? HTTPS (HyperText Transfer Protocol Secure) encrypts the data flowing between your browser and the website. Without it, everything you send and receive is in plain text for anyone on the network to read.
HTTP vs HTTPS
HTTP sends everything in cleartext. Passwords, credit cards, messages, all readable by anyone intercepting the traffic. HTTPS wraps HTTP in a layer of TLS (Transport Layer Security) encryption. Even if someone intercepts the data, they see encrypted garbage instead of your information.
How TLS Works (Simplified)
When you visit an HTTPS site, a TLS handshake happens in milliseconds: Your browser and the server agree on an encryption method. The server presents its SSL/TLS certificate to prove its identity. They exchange keys to create a shared secret. All data flowing between them is now encrypted with that shared secret.
What HTTPS Protects
Data in transit: Login credentials, form submissions, payment info, everything between your browser and the server. Data integrity: Nobody can modify the data in transit without detection. Authentication: The certificate proves you are talking to the real website, not an impersonator.
What HTTPS Does NOT Protect
HTTPS does not hide which websites you visit. Your ISP and DNS provider can still see the domain names. Run a DNS Leak Test to check who sees your DNS queries. HTTPS also does not protect data stored on the server, prevent tracking, or stop browser fingerprinting.
The Certificate System
SSL/TLS certificates are issued by Certificate Authorities (CAs). They verify that the certificate holder controls the domain. Free certificates from Let us Encrypt made HTTPS accessible to everyone. But a padlock does not mean a site is trustworthy, it only means the connection is encrypted. Phishing sites use HTTPS too.
Why It Matters on Public WiFi
On public WiFi, anyone on the same network can potentially intercept your traffic. HTTPS ensures they cannot read it. But if your WebRTC or DNS is leaking, HTTPS alone is not enough. Always verify your full connection security.
Check Your Connection
Look for the padlock. Check that the URL starts with https://. If a site asks for login credentials or payment over HTTP, leave immediately. Use our IP Checker to see your connection details and verify your overall security posture.
Frequently Asked Questions
What is HTTPS and how does it work?
HTTPS (HyperText Transfer Protocol Secure) encrypts the data flowing between your browser and the website by wrapping HTTP in a layer of TLS (Transport Layer Security) encryption. Even if someone intercepts the data, they see encrypted garbage instead of your information.
What is the difference between HTTP and HTTPS?
HTTP sends everything in cleartext, so passwords, credit cards, and messages are readable by anyone intercepting the traffic. HTTPS adds a layer of TLS encryption on top, so intercepted data is unreadable.
What does an SSL/TLS certificate do?
During the TLS handshake, the server presents its SSL/TLS certificate to prove its identity. Certificates are issued by Certificate Authorities that verify the holder controls the domain. A certificate only proves the connection is encrypted, not that the site is trustworthy, since phishing sites use HTTPS too.
Does the padlock mean a website is safe?
No. A padlock only means the connection is encrypted, not that the site is trustworthy. Free certificates made HTTPS accessible to everyone, including phishing sites, which use HTTPS as well. Always judge the site itself, not just the padlock.
What does HTTPS not protect?
HTTPS does not hide which websites you visit, since your ISP and DNS provider can still see the domain names. It also does not protect data stored on the server, prevent tracking, or stop browser fingerprinting.
Last updated: April 2026