What is HTTPS?
HTTPS is the secure version of HTTP, the language your browser uses to talk to websites. It is the reason you see a padlock next to most web addresses, and these days it is on almost every site you visit.
With plain HTTP, everything you send and receive travels across the internet as readable text, so anyone along the way, from the café Wi-Fi to your ISP, could read it or even change it. HTTPS wraps that conversation in encryption that only your browser and the website can unlock.
Before any of that happens, the website has to prove it really is the site you asked for, using a certificate your browser can check. Encryption plus that proof of identity is really all HTTPS is.
Here is the same login, once over plain HTTP and once over HTTPS. Watch what your Wi-Fi and ISP get to read in each case.
With plain HTTP
With HTTPS
How HTTPS works
Step by step
Your browser says hello
When you open an https:// address, your browser first reaches out to the website and says it wants a secure connection. It also lists the kinds of encryption it knows how to use.
The website shows its certificate
The website replies with its certificate, a kind of digital ID card. It says which domain it belongs to, when it expires, and which certificate authority vouched for it.
Your browser checks the certificate
Your browser makes sure the certificate is for the exact site in the address bar, that it has not expired, and that it was signed by an authority your device already trusts. If any of those checks fail, you get a warning page instead of the site.
Both sides agree on a secret key
Next, your browser and the website swap a few public pieces of information, and each combines them with a secret of its own. Both end up with the same key, but anyone watching the exchange cannot work it out.
Everything after that is encrypted
From here on, every request and every page is locked with that key. Your Wi-Fi and ISP can still see which site you are connected to, but not the pages you open, what you type, or what comes back.
One letter makes the difference
The same connection looks very different from the outside depending on whether it uses HTTP or HTTPS. Tap the laptop to switch between them.
What the padlock does and does not mean
The padlock means
- Your connection to the site is encrypted
- You are connected to the site shown in the address bar
- Nobody on the way can quietly change the page
The padlock does not mean
- The site is honest or safe to use
- It is not a scam, since most phishing sites use HTTPS too
- Your ISP cannot see which site you are visiting
HTTPS keeps the conversation between your browser and a website private and tamper-proof, and it proves you reached the real site. It does not hide which site you are visiting, and it does not vouch for the site itself, so a padlock is a good sign, not a guarantee. If you also want to hide where you are going, that is the job of a VPN.
Was this article helpful?
Comments
0Share your thoughts, questions, or feedback about this guide.