In one page

How HTTPS works

That little padlock means your browser and a server you've never met agreed on a secret no one else can read. Here's how they pull it off — in front of everyone.

The problem

The internet is a public road. Every packet between you and a website passes through routers, Wi-Fi, and cables you don't control. Anyone on that road can read plain http:// traffic like a postcard. HTTPS turns the postcard into a sealed envelope — and, crucially, lets you check whose mailbox you're really talking to.

The handshake, in five steps

  1. HelloYour browser says hi and lists the encryption methods it speaks. The server picks one both sides support.
  2. The certificateThe server sends a certificate signed by a trusted authority — proof it really is example.com, not an impostor on the same Wi-Fi.
  3. Check the IDYour browser verifies that signature against authorities it already trusts. If it doesn't add up, you get the scary red warning.
  4. Agree on a secretUsing public-key math, both sides derive the same session key — without ever sending it across the wire for an eavesdropper to grab.
  5. Talk in privateFrom here on, every request and response is encrypted with that shared key. Fast, symmetric, and unreadable to the road.

The clever part is step 4: two strangers compute the same secret while everyone watches, and no observer can reproduce it. That's public-key cryptography, and it's why the padlock can be trusted.

What the padlock does — and doesn't — promise

It promises two things: the connection is encrypted, and the certificate matches the domain in your address bar. It does not promise the site is honest or safe. A scam can buy a certificate too. So the padlock means “no one is listening in,” not “you can trust whoever is on the other end.” Always read the domain, not just the lock.