What HTTPS is
HTTP is the set of rules browsers and servers use to exchange web pages. HTTPS is the same thing wrapped in an encrypted layer, with the “S” standing for secure. The encryption is provided by a protocol called TLS (Transport Layer Security), the successor to an older one named SSL, a name that people still use informally.
Without HTTPS, data crosses the network in readable form. Anyone positioned along the route, such as someone sharing your public Wi-Fi, a compromised router or a network operator, could read or alter it. With HTTPS, those observers see that you are connecting to a particular server but not what you send or receive in the page itself.
Three things HTTPS aims to provide
- Confidentiality: the content is scrambled so that outsiders cannot read it.
- Integrity: the data cannot be quietly changed in transit without detection. This blocks things like injected ads or tampered downloads.
- Authentication: the browser gets evidence that it is talking to the server that really controls the site name, not an impostor.
How a secure connection starts
When your browser connects to a site over HTTPS, the two sides perform a handshake before exchanging page content. Simplified, it goes like this:
- The browser says which TLS versions and encryption methods it supports.
- The server picks from those and sends its certificate.
- The browser checks the certificate (more below).
- Using mathematical techniques, the two sides agree on a shared secret key without sending it openly. The ideas behind this are related to public key cryptography.
- From then on, all traffic is encrypted with that shared key, which is used because it is much faster than the public-key methods used to set it up.
A fresh key is typically generated for each session. Modern TLS versions can complete the handshake in very little time, so the cost to page speed is usually small.
Certificates and the role of authorities
A certificate is a digital document that links a site name to a cryptographic key. It is signed by a certificate authority (CA), an organization that browsers and operating systems have decided to trust. Your device comes with a list of trusted authorities. When it sees a certificate signed by one of them, or by an intermediary that chains back to one, and the name matches the site you asked for, the certificate is accepted.
Certificates also expire, typically after weeks to a year or so, so that stale ones are not trusted forever. Site owners can obtain them from commercial authorities or from free services, and many hosts renew them automatically. The signing process relies on the same mathematical ideas as other cryptographic hashes and digital signatures.
What the padlock does and does not prove
Browsers have shown a padlock icon, or a similar symbol, for secure connections. Designs have changed over time, and some browsers now use a neutral icon instead because the lock was widely misread as an endorsement.
What it indicates:
- The connection between your browser and the site is encrypted.
- The certificate matched the site name shown in the address bar and was issued by a trusted authority.
What it does not indicate:
- That the website is honest, safe or legitimate. Scammers can obtain certificates for their own sites, and many fraudulent pages use HTTPS. A convincing fake bank page with a padlock is still fake.
- That the address is the one you intended. A lookalike name such as one with a swapped letter can have a valid certificate of its own.
- That the site will protect your data once it receives it. Encryption covers data in transit, not what the site does with it afterward.
- That your device is free of malware. Malicious software on your own machine can read information before it is encrypted.
- That your activity is invisible. Your internet provider can usually still see which site names you connect to, and the site itself sees what you do on it.
The practical lesson is to read the address carefully, be wary of links in unexpected messages, and treat the padlock as a basic hygiene check rather than a seal of approval. The articles on online scams and phishing emails cover how to spot these fake pages.
Certificate warnings
If something is wrong, the browser shows a full-page warning. Common causes include:
- an expired certificate, often caused by a site owner forgetting to renew it;
- a name mismatch, where the certificate was issued for a different site;
- an untrusted issuer, such as a self-signed certificate;
- an incorrect clock on your own device, which makes valid certificates look expired or not yet valid;
- someone interfering with the connection, which is rarer but possible.
Treat these warnings seriously. On a site where you would enter a password or payment details, it is usually best to stop rather than click through, particularly if the cause is unclear. Checking your device’s date and time and trying a different network are reasonable first steps.
Mixed content and other details
A page loaded over HTTPS that pulls in some items over plain HTTP, like an image or script, is called mixed content. Browsers often block or flag it because the unprotected item could be tampered with.
Another feature, HSTS, lets a site tell browsers to always use HTTPS in future visits, preventing downgrade attempts. Most major sites now use HTTPS by default, and browsers increasingly warn about sites that do not.
Does HTTPS replace a VPN?
They protect different things. HTTPS protects the connection between you and a particular site. A VPN encrypts traffic between your device and the VPN provider, shifting who can see your activity rather than eliminating it. The two can be used together, and neither makes you anonymous.
Summary of the idea
HTTPS keeps a private, tamper-resistant channel between your browser and a site whose name has been verified. It says little about whether that site deserves your trust, which is a separate judgment you still have to make.