HTTPS Explained: What the Padlock Actually Protects

The padlock in your address bar means one thing: the connection to whoever owns that domain is encrypted. It says nothing about whether that person is honest, which is why phishing sites carry valid certificates too. Over plain HTTP, every header, cookie, and form body is readable by every hop on the path, and those hops can also modify traffic in flight.

HTTPS gives three guarantees: confidentiality, integrity, and server authentication. Integrity is the underrated one, since modern AEAD ciphers (AES-GCM, ChaCha20-Poly1305) make tampering a hard failure rather than a warning. The handshake authenticates the server and agrees a shared symmetric key, because asymmetric crypto is too slow for bulk data, and TLS 1.3 does it in a single round trip.

What it doesn't hide matters just as much: the domain still leaks via SNI and DNS, and traffic size and timing stay visible. HTTPS protects data in transit only, so the server sees plaintext once it arrives.