What Is HTTPS?
HTTPS Explained: HTTP Carried Over TLS
HTTPS (Hypertext Transfer Protocol Secure) is HTTP, the protocol browsers use to request web pages, carried over an encrypted TLS connection. It protects the request and the response while they travel across the network, and it lets the browser verify the server's identity with a certificate.
Plain HTTP sends everything as readable text. Anyone on the path, such as a network operator, the owner of a shared Wi-Fi network or an attacker on the same local network, could read the traffic or change it before it reaches the visitor. HTTPS adds TLS between the browser and the server, so the content is protected in transit.
What HTTPS Encrypts and What Stays Visible
Once the TLS connection is established, the contents of the exchange are encrypted. That includes the full page path and query string, which can reveal, for example, which product a visitor is viewing. It also covers cookies, form data and the page itself.
Some information remains visible to anyone observing the network. The IP addresses of the two computers are visible, because packets must carry them to be routed. The domain name is usually visible too, through the DNS lookup that finds the server and through the server name sent at the start of the TLS connection. Newer techniques aim to hide the server name as well, but they are not yet universal.
What the Certificate and Browser Indicators Show
HTTPS depends on the certificate. If the certificate is valid, trusted, matches the domain and has not expired, the browser connects without a warning. If any of those checks fails, the browser shows a full-page warning instead of the site.
Browsers also label plain HTTP pages. Modern browsers display a 'Not secure' indicator for HTTP sites, particularly on pages that ask for passwords or payment details. A padlock on an HTTPS page shows that the connection is encrypted, but it does not confirm that the business behind the site is honest.
HTTPS is also a requirement for many modern browser features. Geolocation, camera and microphone access, and service workers, which run background code for offline use, are available only in secure contexts, meaning pages loaded over HTTPS. Pages that load some resources over plain HTTP are described in mixed content.
Frequently asked questions
Does HTTPS mean a website is safe?
Not entirely. HTTPS means the connection between the visitor and the server is encrypted and that the server has proven its domain name with a valid certificate. It does not show that the business is legitimate, that the software is free of bugs or that the site is not a phishing copy of another site.
Is HTTPS slower than HTTP?
HTTPS adds a setup step, the TLS handshake, before the first page can be sent. Modern TLS versions keep that step short, and the encryption itself is fast on current hardware. For most websites the difference is small, and the privacy and integrity that HTTPS provides usually outweigh it.