How HTTPS works

See that little padlock next to the address in your browser? Most people have learned to look for it, but few know what it actually does. It's doing more than you think, and less than many people assume.

Without it: a postcard

Without HTTPS, information travels across the internet like a postcard. It passes through many hands along the way: your Wi-Fi router, your internet provider, networks in between. Anyone along that path could read it, including passwords and card numbers.

With it: a sealed, private conversation

HTTPS fixes that in two steps.

First, your browser and the website agree on secret keys. This happens in a fraction of a second when you connect, in a process called a handshake.

Then everything between them is encrypted, turned into scrambled text that only the two of them can unlock. Anyone in the middle sees gibberish.

Proving who it is

Encryption alone isn't enough; you also need to know you're talking to the real site. So the website proves its identity using a certificate issued by a trusted certificate authority. Your browser checks it automatically. That's how it knows it's really talking to your bank and not an impostor.

The result: passwords, card numbers and messages stay private on the way, even on public Wi-Fi at a café or airport.

What the padlock doesn't mean

Here's the important part. The padlock doesn't mean a site is safe or honest. Certificates are free and easy to get, so scam sites can have padlocks too. Many phishing pages do.

The padlock only tells you the connection is private. It says nothing about who's on the other end or what they'll do with your details.

What to check instead

• Look at the address carefully. Is it the one you expect? Watch for lookalikes such as extra words, swapped letters or odd endings.
• Don't follow links to log in. Type the address or use a bookmark for important sites.
• Heed browser warnings. If your browser says a certificate is invalid, stop.

For your own website

If you run a business website, HTTPS is non-negotiable. Browsers mark sites without it as "Not secure", search engines favour HTTPS sites, and customers notice. Most modern hosting includes free certificates that renew automatically.

The bottom line

HTTPS keeps the conversation private. Checking the address keeps you talking to the right people. You need both.

Curious how your own site measures up? Try our useful free tools at nexcentric.com.au/tools.