What TLS actually does

TLS gives three guarantees, and the most useful thing to know about them is that they are separate:

HTTPS is exactly HTTP carried inside that. Not a different protocol — the methods, status codes and fields from track 4 are byte-for-byte identical. Only the envelope changed.

Agreeing on a key in public

The strange part of that run is where the key comes from. Everything you watched crossed a wire an attacker is reading in full, and at the end both sides share a secret the attacker cannot reconstruct.

That is an ephemeral Diffie–Hellman exchange. Each side generates a temporary key pair, sends the public half, and combines its own private half with the other's public half. Both arrive at the same value; an observer who saw both public halves cannot.

The word ephemeral is doing real work: the keys are thrown away when the connection ends, which gives forward secrecy. Traffic recorded today stays unreadable even to somebody who steals the server's long-term private key tomorrow.

What survives the encryption

A great deal less is hidden than people assume. An observer on the path still learns:

• the IP address you connected to, because packets have to be routed;
• the hostname, in most deployments, from the SNI field in the ClientHello;
• the size and timing of every message, which is often enough to identify a page;
• that a connection happened at all, and for how long.

The body is confidential. The metadata around it largely is not — and that is a structural property, not an implementation gap.