What the padlock really means: HTTPS and SSL, honestly

HTTPS is the encrypted version of the web's own language. The padlock in the address bar means two things: the connection between you and the site is encrypted (nobody on the network can read or tamper with what passes), and the site presented a certificate proving that the server answering is the one the address belongs to. SSL is the old name for the technology — the modern version is called TLS — but “SSL certificate” stuck as the everyday phrase.

How the handshake works, without maths

On connecting, the server shows its certificate — a document signed by a certificate authority, an organisation browsers already trust. Your browser checks the signature, the name match, and the dates. If all pass, both sides perform a key exchange and everything afterwards travels encrypted. The whole performance takes a fraction of a second, and certificate authorities such as Let's Encrypt issue the certificates free of charge, which is why the whole web finally went encrypted.

The honest warning: the padlock is not a trust badge

Here is the part most people get wrong, and phishers rely on: HTTPS means the connection is private, not that the site is honest. Any scammer can get a free certificate for a lookalike domain in minutes, and their fake bank page will show the same padlock as the real one. Read the name, not the lock — our suspicious-link guide is built around exactly that. The padlock tells you nobody is eavesdropping; it cannot tell you who is on the other end.

What HTTPS protects, in practice

Passwords, card details, messages and everything else in transit — from the coffee-shop network to the backbone. What it does not cover: a compromised device, a site that mishandles what you send it, or the fact of your visit (the network still sees you talked to that domain). For public networks specifically, our public Wi-Fi guide separates the solved threats from the live ones.

Sources

• Mozilla — What is TLS?