What Is HTTPS and What Does the Padlock Mean?

Quick answer

HTTPS is the encrypted version of HTTP. It uses TLS to encrypt all communication between your browser and a website, so others on the network cannot read or alter it in transit. The padlock shows the connection is protected; it does not prove the site itself is honest or safe.

HTTPS: HyperText Transfer Protocol Secure: HTTP carried inside a connection encrypted with Transport Layer Security (TLS).

What HTTPS adds to HTTP

HTTP is the protocol browsers and web servers use to exchange pages. On its own it sends everything in readable form, so anyone who can observe the connection, such as the operator of a public Wi-Fi hotspot, could read or change the traffic. MDN describes HTTPS as an encrypted version of HTTP that uses TLS to encrypt all communication between a client and a server, which lets sensitive data such as banking details or online shopping information travel safely.

The web convention is to use port 443 for HTTPS, as opposed to port 80 for plain HTTP, although the visible difference to a user is the address beginning with https:// and, in most browsers, a padlock-style indicator.

The three guarantees TLS aims to provide

The current version of the protocol, TLS 1.3, is specified in RFC 8446. Its stated goal is to let client and server applications communicate in a way that is designed to prevent eavesdropping, tampering, and message forgery.

What the TLS layer is designed to provide
Property	What it means in practice
Confidentiality	Someone watching the network sees scrambled data, not the page contents or form entries
Integrity	Content cannot be silently modified between server and browser
Authentication of the server	A certificate lets the browser check that it is talking to the holder of the domain it asked for

How the secure connection is set up

When a browser opens an HTTPS address, it first performs a handshake with the server. The server presents a certificate that ties its domain name to a public key and is signed by a certificate authority the browser already trusts. The two sides then agree on secret keys that only they know and use them to encrypt the conversation. TLS 1.3 was designed to complete this handshake in fewer round trips than older versions, which reduces the delay added by encryption.

Older protocols that came before TLS are commonly called SSL, and the name survives in everyday speech. MDN lists SSL as the predecessor of TLS, so "SSL certificate" today normally refers to a certificate used with TLS.

What the padlock does not tell you

The indicator confirms an encrypted connection to the named domain. It does not say anything about the intentions of whoever runs that domain. A fraudulent site can obtain a certificate for its own misleading address, so a padlock on a lookalike domain is still a lookalike domain.

Reading the padlock correctly
Question	HTTPS can tell you	HTTPS cannot tell you
Can others on the network read this page?	No, the traffic is encrypted	Nothing about the site's honesty
Am I connected to the domain in the address bar?	Yes, if the certificate checks out	Whether that domain is the one you meant
Is the website safe to give my details to?	That the connection itself is protected	That the operator is trustworthy or the content is accurate

The practical habit that follows is to read the domain name itself, not just look for the padlock. A careful look at the address is more informative than the presence of the icon. How a name becomes a destination is covered in the DNS guide.

What HTTPS does not hide

Encryption protects the contents of the exchange, but some information is still visible to the network. An observer may see which server addresses your device connects to and how much data moves, and the lookup of a site name can reveal the name to the resolver used. Your internet provider, a workplace network, and the website operator each see different slices. HTTPS narrows who can see the content; it is not a general privacy tool.

Public networks

HTTPS makes browsing on a shared network far safer than plain HTTP, but it does not protect an account whose password you typed on a fake page. Check the address before entering credentials, wherever you are connected.