How HTTPS works: the lock icon explained

The padlock in your browser means the connection to the site is encrypted. This article explains the piece behind that icon — HTTPS — in plain terms.

HTTP versus HTTPS

HTTP is the basic protocol your browser uses to ask a server for a page. The problem: HTTP sends everything in plain text. Anyone in the middle — your Wi-Fi router, your ISP, a coffee-shop attacker — can read the request and the response.

HTTPS is simply HTTP wrapped in an encryption layer called TLS (Transport Layer Security). The data is still HTTP, but it is encrypted before it leaves your device and decrypted at the server.

The two jobs of HTTPS

1. Encryption — nobody in the middle can read the traffic. This protects passwords, bank details and private messages.
2. Authentication — the server proves it is really who it claims to be, using a certificate. This is what stops a fake site from impersonating your bank.

What happens when you open an HTTPS site

1. Your browser connects to the site, which presents its TLS certificate.
2. The browser checks the certificate — issued by a trusted Certificate Authority (CA), valid dates, matching domain. This is the authentication step.
3. A shared secret is negotiated — using a key exchange (in TLS 1.3, usually ECDHE). Both sides derive the same encryption keys without sending them over the wire.
4. Encrypted communication begins — every request and response is now encrypted with symmetric keys, which are fast.

Certificates and Certificate Authorities

A certificate is a digital document saying "this domain belongs to this organization". It is digitally signed by a CA — a trusted third party like Let's Encrypt, DigiCert or Google Trust Services. Browsers ship with a list of trusted CAs. When a certificate is not trusted (expired, self-signed, or for the wrong domain), the browser shows a warning instead of a padlock.

Why the whole web went HTTPS

Modern browsers mark plain HTTP sites as "Not secure". HTTPS also enables HTTP/2 and HTTP/3, which are faster. Search engines rank HTTPS sites higher. Certificates from Let's Encrypt are free, so there is little reason left to run a site without HTTPS.

FAQ

Is HTTPS the same as HTTP?

No. HTTP sends requests and responses in plain text, so anyone in the middle — a Wi-Fi router, an ISP, an attacker on a shared network — can read them. HTTPS is the same HTTP data wrapped in an encryption layer called TLS: the traffic is encrypted before it leaves your device and decrypted at the server. Everything you can do over HTTP you can also do over HTTPS, just encrypted.

What does the padlock icon actually mean?

The padlock means two things are true: the connection is encrypted (nobody in the middle can read the traffic), and the server has authenticated itself with a valid certificate (a fake site cannot impersonate your bank). It does not mean the site is safe or reputable — only that the connection itself is private and that you are talking to the domain you asked for.

How does the browser know a certificate is trustworthy?

The certificate is digitally signed by a Certificate Authority (CA) — a trusted third party such as Let's Encrypt, DigiCert or Google Trust Services. Browsers ship with a list of trusted CAs. When you open an HTTPS site, the browser checks that the certificate was issued by a trusted CA, that its dates are valid, and that it matches the domain you requested. If all three hold, you get the padlock.

Why does a site show a certificate warning?

The browser shows a warning instead of a padlock when the certificate is not trusted — for example it has expired, is self-signed, or was issued for a different domain. This usually means the connection is not what it claims to be, so you should treat the site with suspicion and avoid entering passwords or payment details.

Summary

HTTPS encrypts your traffic with TLS and proves the server's identity with a CA-signed certificate. It protects passwords, payment details and private content from prying eyes. If a site shows a certificate warning, treat it with suspicion — the connection is not what it claims to be.