What is HTTPS?
When you visit a website, your browser and the web server exchange data across the internet. Without encryption, anyone on the same network could read that data — including your passwords, credit card numbers, and private messages.
HTTPS (HyperText Transfer Protocol Secure) is the encrypted version of HTTP. The "S" means the connection is protected using a protocol called TLS (Transport Layer Security).
How to Spot a Secure Website
Modern browsers make it easy to check if a connection is secure:
- A padlock icon appears in the address bar
- The URL begins with https:// rather than http://
Never enter a password, payment details, or personal information on a website that only uses HTTP (no padlock). Your data could be intercepted.
How HTTPS Works: The TLS Handshake
When your browser connects to an HTTPS website, a process called the TLS handshake happens in milliseconds:
- Your browser contacts the server and says "I want a secure connection" and lists the encryption methods it supports.
- The server responds with its digital certificate (proof of its identity) and its public key.
- Your browser checks the certificate is valid (signed by a trusted authority) and uses the public key to securely share a session key.
- Both sides now use the shared session key with symmetric encryption (AES) for the rest of the conversation.
This clever combination uses asymmetric (public-key) encryption just to exchange the session key, then fast symmetric encryption for all the actual data.
A digital certificate is like a passport for a website. It is issued by a trusted organisation called a Certificate Authority (CA), and it proves the website really is who it claims to be.
Why HTTPS Matters
HTTPS protects you in three ways:
| Protection | What it means |
|---|---|
| Confidentiality | Only you and the website can read the data |
| Integrity | Data cannot be changed in transit without being detected |
| Authentication | The certificate proves you are talking to the real website, not an imposter |
HTTPS Everywhere
Today, almost all websites use HTTPS. Search engines like Google rank HTTPS sites higher, and modern browsers warn users when visiting HTTP sites. If you are building a website, using HTTPS is no longer optional — it is expected.
Practice Problems
Describe two things you should check before entering your bank account password on a website.
Show answer
Explain why HTTPS uses both asymmetric and symmetric encryption rather than using just one type.