HTTPS is HTTP over TLS encryption: data between your browser and the site cannot be read or altered in transit, and the site proves it controls the domain in the address bar. The padlock says exactly that and nothing more. It does not say the site is honest, safe or who it claims to be: phishing pages almost always have HTTPS, because a certificate takes a minute and costs nothing. Knowing what the padlock guarantees and what it does not is more useful than just looking for it.

What happens in an HTTPS connection

  1. The browser connects to the server and asks to start TLS.
  2. The server sends a certificate: a document in which a certificate authority vouches that this key belongs to this domain.
  3. The browser checks the authority's signature, the expiry date, and that the domain matches.
  4. The two sides agree on a session key, and everything after that is encrypted.

The current version is TLS 1.3: one fast handshake and only strong algorithms.

What HTTPS protects

  • Content: pages, forms, passwords, card numbers, messages. Your ISP, the café Wi-Fi and anyone in between see only an encrypted stream.
  • Integrity: nobody on the path can inject an ad, a script or a swapped link into the page.
  • Domain authenticity: you are talking to whoever controls the domain in the address bar, not to someone who intercepted the connection.

What HTTPS does not protect

  • The site's honesty. yourbank-secure-login.com with a padlock is not your bank. The padlock confirms the domain, not the intent. Read the address, not the icon.
  • The site's name from your ISP. The domain travels in plain text in the DNS query and in the SNI field at the start of the connection. The ISP knows what you opened, not what was inside. Details in what can my ISP see.
  • Your IP address. The site sees it; HTTPS has nothing to do with that.
  • Your data inside the site. What the site does with what you submit is a policy matter.
  • Your device. Malware on the phone reads everything before it is encrypted.

Reading the browser's indicators

  • Padlock, or the neutral "tune" icon in recent Chrome: encrypted, certificate valid.
  • "Not secure": plain HTTP. Do not enter anything that matters.
  • A red certificate warning: expired, issued for a different domain, or signed by an authority the browser does not trust. On someone else's network this can mean interception. Do not click through, especially for banks and email.
  • Click the padlock: it shows who the certificate was issued to and by. For a bank, expect the bank's name or a known authority, not nothing.

HTTPS-only mode

Browsers can refuse to open the unencrypted version of a site. Chrome: Settings → Privacy and security → Security → "Always use secure connections". Firefox: Settings → Privacy & Security → "HTTPS-Only Mode". Turn it on; it closes the rare but painful cases where a link leads to http://.

HTTPS on public Wi-Fi

In a café, HTTPS does the main job: content is unreadable. Three gaps remain: DNS queries, the network's login page, which is often plain HTTP, and apps that are less strict than a browser. What to do about them is in is public Wi-Fi safe.

HTTPS and VPN: layers, not substitutes

HTTPS encrypts content between you and the site. A VPN encrypts all of the device's traffic between you and the VPN server, including DNS and site names, and hides your IP. One without the other leaves gaps: without HTTPS the VPN server could read content; without a VPN the ISP gets the site list. Together they cover nearly everything. The DNS half of that is explained in what is DNS.

In short

  • Padlock = encryption + verified domain. Not = honest site.
  • Read the address, not the icon. A certificate warning means stop.
  • Turn on HTTPS-only mode.
  • The ISP still sees site names; only a VPN, or encrypted DNS plus ECH where supported, closes that.

404 VPN builds its tunnel with VLESS or WireGuard over TLS 1.3 and carries DNS inside it, so site names are not visible to the network. Details on the security page; get started here.