What HTTP and HTTPS Actually Are
HTTP stands for HyperText Transfer Protocol. It's the set of rules that governs how data travels between your browser and a website's server. Think of it as the language your browser and a website use to talk to each other. Every time you load a page, your browser sends an HTTP request — essentially asking the server, "Please send me this page" — and the server responds.
HTTPS adds one critical layer: the letter S stands for Secure. Under HTTPS, that same conversation happens through an encrypted tunnel powered by a technology called TLS (Transport Layer Security). Encryption scrambles the data so that even if someone intercepts it mid-journey, they see only meaningless characters instead of readable information.
To understand why this matters, consider a postcard versus a sealed envelope. HTTP is the postcard — anyone who handles it along the way can read exactly what's written. HTTPS is the sealed envelope — only the intended recipient can open and read it. For more on what happens during the journey between your keyboard and a loaded webpage, see what actually happens when you type a web address.
HTTP vs. HTTPS: A Side-by-Side Look
The differences between the two protocols go beyond a single letter. Here's a direct comparison of what sets them apart in practice.
| Criterion | HTTP | HTTPS |
|---|---|---|
| Data transmission | Plain text — readable if intercepted | Encrypted — unreadable if intercepted |
| Padlock in browser | No — often shows 'Not Secure' | Yes — padlock icon displayed |
| Security certificate required | No | Yes (TLS/SSL certificate) |
| Safe for passwords & payments | No | Yes (connection-level protection) |
| Default for modern websites | No — being phased out | Yes — now the standard |
| Guarantees site is legitimate | No | No — only encrypts the connection |
One point worth emphasizing: the padlock icon your browser displays is the visual signal that HTTPS is active and the site's security certificate is valid. Most modern browsers — including Chrome, Firefox, Safari, and Edge — actively label HTTP sites as "Not Secure", particularly when a page contains form fields.
What the Padlock Does (and Doesn't) Guarantee
The padlock tells you one specific thing: your connection to the site is encrypted. It does not tell you that the site itself is honest, legitimate, or safe to use. A fraudulent website can — and often does — use HTTPS. Scammers know that many users associate the padlock with trustworthiness, so they obtain free security certificates for their fake sites.
This is an important distinction. HTTPS protects the channel, not the destination. Think of it this way: an armored truck safely delivers a package — but the armored truck doesn't verify whether the package contains something legitimate. Always check the full web address (URL) carefully, especially the domain name, before entering any personal information.
Free Certificates Changed Everything
Organizations like Let's Encrypt began offering free TLS certificates around 2016, removing a significant cost barrier for smaller websites. This contributed to HTTPS adoption spreading rapidly across the entire web, not just large commercial sites. Today, obtaining a certificate is a routine step for anyone launching a website.
Building good habits around this kind of awareness is part of broader internet safety. Our guide on internet safety habits worth building from day one covers phishing awareness and safer browsing in practical terms.
Why Almost Every Site Now Uses HTTPS
For most of the web's early history, HTTPS was reserved for banking and shopping sites. That changed significantly as awareness of online privacy grew and the cost of obtaining security certificates dropped — including the arrival of free certificate authorities that made HTTPS accessible to any website owner.
~95%
Of Chrome browser traffic loaded over HTTPS
Google's transparency report has tracked HTTPS usage in Chrome and consistently reported figures at or above this level across major platforms.
0
Cost to obtain a basic TLS certificate today
Free certificate authorities such as Let's Encrypt have made HTTPS accessible to any website owner, eliminating cost as a barrier to adoption.
Search engines also began factoring HTTPS into how they rank websites, creating an additional incentive for site owners to upgrade. Today, the vast majority of web traffic is encrypted, and browsers treat HTTP as the exception rather than the rule.
If you use a browser to navigate the web regularly, it's worth understanding how the browser itself fits into your security picture — see the difference between an app and a browser for a helpful primer. And for a full picture of keeping your devices protected, the gadget security checklist is a useful companion resource.
