Keeping it private with HTTPS

How does the padlock keep what you send private?

Your packets cross many networks, and whoever runs one can copy what passes through. With plain HTTP, the copy is readable.

The fix is HTTPS: HTTP sent inside TLS, which works like a sealed envelope only the recipient can open.

First, your browser and the site have a short opening exchange, a handshake. It does two jobs.

1. They agree a secret. Each side sends some numbers, and both work out the same secret from them. Someone who sees every number still can't work it out.
2. The browser checks the site's ID. The site sends a certificate, like an ID card signed by someone both sides trust.

After that, everything is encrypted: scrambled so only the two ends can read it.

Press play. The run also shows what an observer on the path can read.

HTTPS doesn't hide everything. An observer still sees the site's name and its IP address, because the packets need them to be delivered. They also see when you visited, and roughly how much was sent. What stays hidden is which page you asked for, and anything you typed into it.

The padlock beside the site's name means two things: the connection is encrypted, and the certificate passed its checks. It doesn't mean the site itself is honest.