What Is HTTPS?
When you see a padlock icon in your browser's address bar, you're using HTTPS — the secure version of HTTP. The "S" stands for Secure, and it means the connection between your browser and the server is encrypted.
Think of the difference like sending a postcard versus a sealed envelope. With regular HTTP, anyone handling your message along the way could read it. With HTTPS, your message is locked inside an envelope that only the intended recipient can open.
Why Encryption Matters
When you send data over the internet, it passes through many intermediate systems — routers, internet service providers, and network equipment. Without encryption, anyone with access to these systems could potentially read your data.
This matters enormously for sensitive information. When you enter a password, credit card number, or personal details, you want that information protected. HTTPS ensures that even if someone intercepts your data, they see only scrambled nonsense.
But HTTPS isn't just for sensitive data. It also verifies that you're actually talking to the server you think you're talking to, preventing attackers from impersonating legitimate websites.
How It Works (Conceptually)
HTTPS uses a technology called TLS (Transport Layer Security) to establish secure connections. When your browser connects to an HTTPS site, several things happen:
- The server presents a certificate — a digital document that proves its identity
- Your browser verifies this certificate is legitimate and hasn't expired
- The browser and server agree on encryption keys
- All subsequent communication is encrypted
Certificates are issued by trusted Certificate Authorities (CAs). Your browser comes with a list of CAs it trusts, allowing it to verify certificates automatically.
The Modern Web Standard
HTTPS has become the default for the web. Browsers now warn users when sites don't use HTTPS, and many features (like accessing your camera or location) only work on secure connections.
For website owners, obtaining certificates has become easy and free through services like Let's Encrypt. There's no longer any good reason for websites to use unencrypted HTTP.
When you see that padlock, you know your connection is private. When you don't, be cautious about what information you share.