How HTTPS locks your data in transit

The padlock in your browser's address bar means the connection uses HTTPS: ordinary web traffic wrapped in a protocol called TLS, short for Transport Layer Security. It solves a hard problem. Your browser and a website that have never met must agree on a secret over a network anyone can listen to, and they have a fraction of a second to do it.

Step 1: The handshake says hello

When you open a site, your browser sends a hello message listing the TLS versions and encryption methods it supports. In TLS 1.3, the current version, that first message already includes the browser's half of a key exchange. The server replies with its choices, its own half of the exchange and its certificate. The whole setup takes a single round trip across the network.

Step 2: Public-key math creates a shared secret

The key exchange uses public-key cryptography, typically elliptic-curve Diffie-Hellman. Each side generates a private value it never sends, plus a matching public value it shares openly. By combining its own private value with the other side's public value, each side arrives at the same shared secret. An eavesdropper sees both public values but cannot work out the secret, because reversing the math is computationally infeasible. Major browsers have also started pairing this step with newer post-quantum methods designed to resist future quantum computers.

A fresh secret is created for every connection, so even if a server's long-term key leaks later, recordings of past sessions stay unreadable. This property is called forward secrecy.

Step 3: Certificates prove who is on the other end

A shared secret is worthless if you share it with an impostor. The certificate prevents that. It contains the site's domain name and public key, and it is digitally signed by a certificate authority (CA), an organization your browser or operating system already trusts. Before continuing, your browser checks that:

• the signatures chain back to a trusted root CA,
• the name on the certificate matches the site you asked for,
• the certificate is still within its validity period.

The server also signs the handshake with its private key, proving it actually holds the key named in the certificate.

Step 4: Fast symmetric encryption takes over

Public-key math is relatively slow, so it is only used for setup. From the shared secret, both sides derive symmetric keys, and everything after that, every page, image and form you submit, is encrypted with a fast cipher such as AES-GCM or ChaCha20-Poly1305. These ciphers also detect tampering: if anyone changes even one bit in transit, the data is rejected.

Why it matters

HTTPS stops people on the same coffee shop Wi-Fi, or anywhere along the route, from reading or altering what you send. It does not prove a site is honest, only that you are really connected to the domain in the address bar, so a scam site can show a padlock too. It also usually does not hide which site you are visiting, only what you do there. Check the domain name, and treat the padlock as privacy in transit, not a seal of approval.