HTTPS is HTTP layered over TLS encryption. It protects data traveling between a browser and a website so others on the network cannot read or tamper with it, and it verifies the site's identity using a certificate.
When a browser connects to an HTTPS site, the two perform a TLS handshake to agree on encryption keys and check the site's certificate. After that, all data exchanged is encrypted, so anyone in between on the network sees only scrambled bytes.
HTTPS protects data in transit from eavesdropping and tampering, and it authenticates the site through its certificate so you are less likely to connect to an impostor. It does not, by itself, prove that the organization running the site is trustworthy.
Because HTTPS keeps passwords, payment details, and other data private in transit, browsers now mark plain HTTP pages as not secure and expect sensitive pages to use HTTPS. Many modern web features are also available only over HTTPS.
Home · By Runze