How HTTPS and SSL/TLS Work
IntermediateHTTPS is HTTP with an encryption layer called TLS (Transport Layer Security). Before any data is exchanged, your browser and the server perform a handshake — agreeing on encryption methods, verifying the server's identity via a digital certificate, and exchanging keys. All subsequent communication is encrypted so that no one intercepting the traffic can read it. The padlock icon in your browser means this handshake succeeded.
Think of HTTPS like sealed tamper-evident envelopes
When you write a letter, anyone who handles it can read it (HTTP). HTTPS is like putting your letter in a special envelope that: (1) has a tamper-evident seal — any interception shows up, (2) can only be opened by the intended recipient who holds the matching key, and (3) comes with a verified return address certified by a trusted authority, so you know you're actually talking to your bank and not an impostor.
Step by Step
Key Concepts
TLS (Transport Layer Security)
The cryptographic protocol that provides secure communication over the internet. TLS 1.3 (2018) is the current standard. Its predecessor SSL (Secure Sockets Layer) is deprecated but the terms are often used interchangeably. HTTPS = HTTP + TLS.
SSL Certificate
A digital document issued by a Certificate Authority that binds a public key to a domain name. Contains: domain name, public key, issuer (CA), validity period, and a digital signature from the CA. Proves you're talking to the real server, not an impostor.
Certificate Authority (CA)
A trusted organisation that verifies website identity and issues digital certificates. Browsers and operating systems ship with 100-200 pre-trusted root CAs. Let's Encrypt issues free certificates automatically and powers ~60% of the web.
Public Key Cryptography
Asymmetric encryption using a key pair: a public key anyone can see, and a private key only the server holds. Data encrypted with the public key can only be decrypted with the private key. Used during the handshake to establish the shared secret.
Diffie-Hellman Key Exchange
A mathematical method for two parties to independently derive the same secret key without transmitting it. Works even if all communications are monitored. The mathematical foundation of TLS 1.3's key exchange and the reason HTTPS provides "forward secrecy".
Forward Secrecy
A property of TLS 1.3 key exchange — each session uses a unique key pair. Even if a server's private key is compromised in the future, past encrypted traffic cannot be decrypted retroactively. TLS 1.2 with static RSA key exchange did not have this property.
Mixed Content
When an HTTPS page loads resources (images, scripts, CSS) over HTTP. Browsers block active mixed content (scripts/frames) entirely and warn about passive content. If any resource is loaded insecurely, the full-page security guarantee is weakened.
Key Facts
- As of 2025, over 95% of web traffic is encrypted with HTTPS — up from less than 50% in 2016, driven largely by Let's Encrypt making free certificates available.
- Let's Encrypt has issued over 4 billion certificates since launching in 2016 and currently secures over 350 million active domains.
- TLS 1.3 (2018) reduced the handshake from 2 round trips to 1 (and 0 for resumed sessions), making HTTPS faster than the TLS 1.2 it replaced.
- The padlock icon in browsers dates to Netscape Navigator 1.0 in 1994 — one of the most recognisable security symbols in the world.
- Breaking 256-bit AES encryption by brute force would take longer than the estimated age of the universe, even with all computing power on Earth.
- HTTPS is required for many modern browser features: service workers, geolocation API, camera/microphone access, and HTTP/2 all require secure connections.
Real-World Applications
Online Banking and Payments
Every credit card transaction, bank login, and UPI payment is protected by TLS. Without HTTPS, account credentials and card numbers would be visible to anyone on the same WiFi network.
Login and Authentication
Passwords transmitted over HTTP are visible in plaintext to network observers. HTTPS is the minimum requirement for any form with a password field — browsers now actively warn users on HTTP login pages.
API Security
REST APIs and mobile apps use HTTPS to secure data between client and server. Without it, API keys, auth tokens, and user data could be intercepted by any device on the network path.
SEO Ranking
Google has used HTTPS as a ranking signal since 2014. Websites without HTTPS are marked "Not Secure" in Chrome and rank lower in search results — creating strong commercial incentives for adoption.
Public WiFi Security
On a coffee shop or airport WiFi, all unencrypted HTTP traffic is visible to the router operator and anyone using a packet sniffer. HTTPS ensures your browsing is private even on untrusted networks.
Frequently Asked Questions
Does HTTPS mean a website is safe?
HTTPS means communication with the server is encrypted and authenticated — but it says nothing about what the server does with your data. A scam website can and often does have a valid HTTPS certificate. The padlock proves you're securely connected to the real domain, not that the site is trustworthy. Always verify the domain name in the address bar.
What is the difference between HTTP and HTTPS?
HTTP (Hypertext Transfer Protocol) sends data in plaintext — visible to anyone on the network path. HTTPS adds TLS encryption on top of HTTP, encrypting all data and authenticating the server's identity. HTTPS runs on port 443 (HTTP on port 80). Modern browsers redirect HTTP to HTTPS automatically for most sites.
Can HTTPS be hacked or decrypted?
The encryption itself (AES-256) is effectively unbreakable by brute force. Practical attacks target implementation flaws (HeartBleed, POODLE), weak certificate issuance (misissued certificates), or endpoints rather than the encrypted channel. This is why SSL pinning, certificate transparency logs, and regular TLS version updates matter.
What happens when an SSL certificate expires?
Browsers show a full-page warning blocking access. This happens because an expired certificate can't prove the server still controls the private key — the guarantee that you're talking to the right server breaks down. Servers should auto-renew certificates (Let's Encrypt auto-renews every 90 days). Expiry is one of the most common causes of website outages.