The short answer
HTTPS is the secure version of HTTP. The "S" stands for secure, meaning all data exchanged between your browser and the website is encrypted using SSL/TLS certificates, protecting passwords, payment details and personal information from interception by third parties.
HTTP VS HTTPS
HTTP (Hypertext Transfer Protocol) and HTTPS (HTTP Secure) are both protocols that transfer data between your web browser and websites. The fundamental difference is that HTTPS encrypts this data, while HTTP sends it in plain text. When you visit an HTTP site, anyone positioned between you and the server—your internet provider, someone on your WiFi network, or a malicious actor—can read everything you send and receive. HTTPS prevents this by scrambling the data so only you and the intended website can understand it.
How SSL/TLS Certificates Work
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) certificates are the technology that enables HTTPS encryption. TLS is the modern, more secure successor to SSL, though people often use the terms interchangeably. These digital certificates serve two purposes: they encrypt data and verify that you're actually communicating with the legitimate website, not an impostor.
When you connect to an HTTPS website, your browser and the server perform a "handshake" in milliseconds:
- Your browser requests the secure connection
- The server sends its SSL/TLS certificate, which contains a public encryption key
- Your browser verifies the certificate is valid and issued by a trusted authority
- Both sides agree on encryption methods and create unique session keys
- All subsequent data travels encrypted using these keys
Certificate Authorities and Trust
SSL/TLS certificates are issued by Certificate Authorities (CAs), organizations that verify a website owner's identity before issuing a certificate. Your browser maintains a list of trusted CAs. When you visit an HTTPS site, your browser checks whether a trusted CA signed the certificate. If the certificate is expired, self-signed, or issued by an unknown authority, your browser displays a security warning.
Practical Implications
You can identify HTTPS sites by the padlock icon in your browser's address bar and the "https://" prefix in the URL. Modern browsers now mark HTTP sites as "Not Secure" to warn users. Never enter passwords, credit card numbers, or sensitive personal information on HTTP sites. Even for browsing public content, HTTPS protects your privacy by preventing others from seeing which specific pages you visit on a domain.
Website owners obtain certificates from CAs, with options ranging from free automated certificates (like Let's Encrypt) to paid certificates that include additional validation and insurance. The encryption strength is similar across certificate types; the main differences lie in the validation level and support services provided.