How HTTPS Works: SSL/TLS Explained Simply

You have seen the padlock icon in your browser address bar thousands of times. When you click it, your browser tells you something like 'Connection is secure' or lists a certificate. But what does any of that actually mean? What is being secured, and from what?

This guide explains how HTTPS works without requiring a background in cryptography.

HTTP vs HTTPS

HTTP (HyperText Transfer Protocol) is the foundation of all web communication. When you load a page over HTTP, every piece of data -- your login form, the page content, your cookies -- travels as plain text. Anyone with access to your network connection, whether that is your ISP, a cafe Wi-Fi operator, or anyone with the right tools, can read it.

HTTPS adds a security layer called TLS (Transport Layer Security) on top of HTTP. TLS encrypts the data before it leaves your device and decrypts it only at the server. Anyone intercepting the traffic in between sees random bytes that are useless without the decryption key.

The TLS Handshake

Before any encrypted data is exchanged, your browser and the server perform a handshake to agree on how to communicate. The process happens in milliseconds and has a few key steps.

Step 1: Client Hello. Your browser sends a list of TLS versions and cipher suites it supports, along with a random number that will be used later.

Step 2: Server Hello. The server picks the strongest option both sides support and sends back its SSL certificate. The certificate contains the server's public key and is signed by a Certificate Authority (CA) -- a trusted third party.

Step 3: Certificate verification. Your browser checks whether the certificate is signed by a CA it trusts (browsers ship with a list of trusted CAs), whether it has expired, and whether the domain name on the certificate matches the site you are visiting.

Step 4: Key exchange. Browser and server use the public key to exchange a shared secret. From that secret, both sides independently derive the same symmetric encryption key, without ever transmitting the key itself over the network.

Step 5: Encrypted communication begins. All subsequent traffic is encrypted with that symmetric key. Even if an attacker recorded the entire handshake, they cannot derive the key without the server's private key.

What the Padlock Means (and What It Does Not)

The padlock tells you two things: the connection is encrypted, and the certificate was issued for the domain you are visiting.

It does not tell you the website is trustworthy or legitimate. A phishing site can get a valid HTTPS certificate just as easily as a legitimate one. Attackers use HTTPS specifically because users trust the padlock. A padlock on paypa1.com means the connection to that fake site is encrypted -- which is cold comfort.

Certificate Authorities and Trust

Your browser trusts around 150 Certificate Authorities by default. If any of these CAs signs a certificate for a domain, your browser will trust it. This is why CA security matters so much -- a compromised CA can issue fraudulent certificates for any domain.

Certificate Transparency (CT) logs are a public record of every certificate ever issued. They make it possible to detect unauthorized certificates quickly. You can search CT logs using the subdomain finder tool on this site to see what certificates have been issued for any domain.

Modern TLS: Version Matters

TLS 1.3 (released 2018) is significantly faster and more secure than older versions. It removes support for weak algorithms that were responsible for several high-profile attacks. TLS 1.0 and 1.1 are deprecated and disabled in all modern browsers.

When you check a site's SSL certificate with this site's SSL Checker tool, one of the things it reports is the TLS version the server uses. If a server still supports TLS 1.0 or 1.1, it needs to be updated.

Practical Takeaways

Always check for HTTPS before submitting any sensitive information. Use a password manager that autofills only on the correct domain, which protects against lookalike phishing domains. Check SSL certificate details on any site you are auditing to confirm it is current, properly configured, and issued to the right organization.