HTTPS

Definition

An extension of the Hypertext Transfer Protocol (HTTP) that uses encryption protocols (SSL/TLS) to secure communications between a web browser and a website server.

What Problem It Solves

HTTPS solves the massive security problem of clear-text web traffic. By establishing an encrypted tunnel using SSL/TLS, it ensures that all headers, cookies, query parameters, and payload data are fully secure from interception, tampering, or eavesdropping on public networks.

What Happens If Not Used

Without HTTPS, sensitive actions like logging in, making payments, or transmitting personal data would be sent in plain text, making it trivial for malicious actors, ISPs, and hackers on the same network to steal credentials and hijack sessions.

Easy Wording

It is the exact same as HTTP, but it adds a secret code (encryption) so that nobody else on the internet can read or tamper with the messages you send and receive.

Layman Example

Sending a letter in an open envelope is HTTP—anyone along the mail route can open it and read it. Sending the same letter in a locked, armored steel briefcase that only you and the recipient have the key to is HTTPS.

Technical Example

When initiating an HTTPS request, the browser and server perform a TLS Handshake:

1. Client Hello: Browser sends supported cipher suites.
2. Server Hello: Server sends certificate with its public key.
3. Key Exchange: Client verifies the certificate, generates a symmetric session key, encrypts it with the server's public key, and sends it.
4. Encrypted Channel: Both parties use the session key to encrypt all subsequent HTTP headers and payload data.