What does HTTPS add to HTTP?
Quick answer
HTTPS adds security to the standard HTTP protocol by wrapping it in TLS (Transport Layer Security, the successor to SSL). That gives three protections: encryption (others can’t read your data), authentication (you’re connected to the real website) and integrity (data can’t be secretly changed on the way).
When you see https:// at the start of a web address, the extra “s” is doing important work behind the scenes.
HTTP vs HTTPS
| HTTP | HTTPS | |
|---|---|---|
| Stands for | HyperText Transfer Protocol | HyperText Transfer Protocol Secure |
| Data | Sent as plain text | Encrypted |
| Default port | 80 | 443 |
| Browser label | Often “Not secure” | Padlock icon |
| Needs a certificate? | No | Yes |
How it works, simply
- Your browser connects to a website and asks for its certificate.
- The certificate, issued by a trusted certificate authority, proves the site owns its domain.
- Browser and server agree on secret keys in a process called the TLS handshake.
- Everything after that, including passwords, card numbers and messages, is encrypted.
Anyone snooping on the network, for example on public café Wi-Fi, sees only scrambled data.
What the padlock does NOT mean
HTTPS shows the connection is private, not that the site is honest. Scam and phishing sites can also use HTTPS. Always check the web address carefully before entering passwords or payment details.
Why almost every site uses HTTPS now
- Since around 2018, Chrome and other browsers label plain HTTP pages “Not secure.”
- Google gives a small ranking boost to secure sites.
- Free certificates from Let’s Encrypt, launched in 2015, made HTTPS easy and cheap for everyone.
Today, the vast majority of web pages loaded in browsers use HTTPS.
Where HTTPS came from
HTTPS was first introduced by Netscape in 1994 for its browser; see what Netscape Navigator was. HTTP itself was created by Tim Berners-Lee as part of the World Wide Web.
Curious what websites can see about you? Read what your IP address is.
Still curious?
Jump to a random question from the archive.