HTTPS.
A locked box you and the website both hold a key to, agreed out in the open.
Imagine sending a postcard through the mail. Anyone who handles it — the postal workers, your neighbour who grabs the mail — can read every word. Plain HTTP is exactly that postcard: every router between you and the website can see what you send.
HTTPS puts that postcard inside a locked steel box. Before any real data moves, your browser and the website do a quick negotiation and end up sharing a secret key. From then on everything is scrambled with it, so the people carrying the box just see a meaningless lump of metal.
- Dear Bank, my password is hunter2.1
Plain HTTP is a postcard — your password written right out in the open.
- hunter2, eh? Noted.2
So everyone who carries it on the way can read every word.
- They agreed a secret… how?!3
HTTPS opens with a handshake: a shared secret agreed in plain sight that no eavesdropper can copy.
- Signed and sealed.4
The site also shows ID — a certificate signed by an authority your browser trusts.
- …it’s gibberish.5
Everything after is sealed with that secret. To anyone in between, it’s a brick.
- Read that, Snoop.6
Two promises in one padlock: nobody can read it, and you know who’s on the other end.
How they agree a secret in public
The magic is a trick called a key exchange. The two sides each pick a private number, mix it with a shared starting value, and swap the mixtures. Each can then combine the other’s mixture with their own private number and land on the exact same final secret.
Anyone eavesdropping sees the mixtures but not the private numbers, and un-mixing them is so hard it is effectively impossible. So two strangers end up with a shared key without ever sending it.
Why the padlock means two things
Encryption alone would let an impostor set up their own locked box and pretend to be your bank. So HTTPS also checks identity: the certificate is signed by a trusted authority, and your browser refuses the connection if it does not check out.
That is why the padlock is shorthand for both promises at once — nobody can read the conversation, and you are really talking to who you think you are.