How it works
The browser verifies a digital certificate for the site's domain, then establishes encryption keys for the session. This protects transport, not everything a site may do with submitted information.
What people often miss
A padlock does not prove that a website is trustworthy or that its content is accurate. It means the connection is encrypted and authenticated to the certified domain.
Why this question comes up
Modern browsers warn strongly when sensitive forms use unencrypted HTTP.
Key points
- HTTPS is HTTP carried through an encrypted TLS connection, helping protect data from being read or altered between a browser and a website.
- The browser verifies a digital certificate for the site's domain, then establishes encryption keys for the session. This protects transport, not everything a site may do with submitted information.
- A padlock does not prove that a website is trustworthy or that its content is accurate. It means the connection is encrypted and authenticated to the certified domain.
Bottom line
HTTPS is HTTP carried through an encrypted TLS connection, helping protect data from being read or altered between a browser and a website.
Source and verification
This Answer was checked against Mozilla. Follow the source for the full official explanation and any later updates.