Glossary · ENCheck a domain

HTTPS

A browser and website use HTTPS to protect data as it travels between them and to check the server's identity for the requested domain. HTTPS carries HTTP requests and responses over a connection protected by Transport Layer Security (TLS). It can also use a system such as QUIC that provides TLS security for HTTP/3. In a web address, HTTPS is shown by the https:// address prefix, called the scheme, and usually by a browser security indicator.

What does HTTPS protect?

TLS encrypts the data exchanged by the browser and server so that someone observing the network connection cannot ordinarily read its contents. It also protects the data from undetected alteration and lets the browser authenticate the server using a certificate. The certificate helps the browser check that it is communicating with a server authorized for the requested domain name.

For example, when Alex signs in at https://example.com, the browser first establishes a protected connection and checks the certificate for example.com. The login data is then sent through that protected connection. The site still needs to handle and store the information safely after receiving it; HTTPS cannot prevent a dishonest site from misusing data that the visitor submits.

What do a certificate and the lock indicator mean?

A TLS certificate is a digitally signed document that binds a public key to names or other identity information. The browser checks whether the certificate is valid for the requested name and whether a chain of digital signatures links it to a certificate issuer trusted by the browser. A certificate and the TLS connection work together: the certificate helps authenticate the server, while TLS encrypts the connection and protects its data against undetected changes.

HTTPS does not prove that a business is legitimate, that a page is free of scams, or that its content is accurate. A phishing site can also use HTTPS. The browser indicator shows that the connection passed the browser's security checks; readers still need to judge the site and the request for information.

Is HTTPS just a different version of HTTP?

HTTP defines the request and response between a client and a server. HTTPS uses those same HTTP rules for requests and responses over a protected connection. HTTP versions differ in how they send messages: for example, HTTP/3 carries the same general requests and responses using QUIC rather than TCP, the system used to carry HTTP/1.1 messages. A DNS record can help the browser find a server, but HTTPS security is established separately when the browser connects.

Related terms