What is HTTPS?
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP that encrypts all communication between a web browser and server using TLS (Transport Layer Security). It protects data integrity, confidentiality, and authenticates the server's identity.
Quick Facts
| Full Name | Hypertext Transfer Protocol Secure |
|---|---|
| Created | 1994 by Netscape |
| Specification | Official Specification |
How It Works
HTTPS was developed by Netscape in 1994 for their Navigator browser. It wraps HTTP inside TLS encryption, preventing eavesdropping, tampering, and man-in-the-middle attacks. HTTPS uses digital certificates issued by Certificate Authorities (CAs) to verify server identity. Modern browsers mark HTTP sites as 'Not Secure' and require HTTPS for features like geolocation, service workers, and HTTP/2. Let's Encrypt has made free TLS certificates widely available, accelerating HTTPS adoption. HTTPS typically uses port 443 instead of HTTP's port 80. HTTP/3 (2022) replaces TCP with QUIC (Quick UDP Internet Connections), eliminating head-of-line blocking at the transport layer. QUIC provides built-in encryption, faster connection establishment (0-RTT), and improved performance on unreliable networks. Major browsers and CDNs now support HTTP/3, making it the future of web transport.
Key Characteristics
- Encrypts all data in transit using TLS
- Authenticates server identity via certificates
- Protects against eavesdropping and tampering
- Uses port 443 by default
- Required for modern web features
- Visual indicator (padlock) in browsers
Common Use Cases
- Secure website communication
- Online banking and e-commerce
- Login and authentication pages
- API security
- Any site handling sensitive data
Example
Loading code...Frequently Asked Questions
What is the difference between HTTP and HTTPS?
HTTPS is HTTP with encryption. While HTTP sends data in plain text that can be intercepted and read, HTTPS encrypts all communication using TLS (Transport Layer Security). HTTPS also verifies server identity through certificates, preventing man-in-the-middle attacks. HTTPS uses port 443 by default, while HTTP uses port 80.
How do SSL/TLS certificates work?
TLS certificates contain the server's public key and identity information, digitally signed by a Certificate Authority (CA). When you connect to a site, your browser verifies the certificate against trusted CAs, checks it hasn't expired, and confirms the domain matches. The certificate enables encrypted key exchange to establish a secure session.
What is a Certificate Authority (CA) and why is it important?
A Certificate Authority is a trusted organization that verifies website ownership and issues digital certificates. CAs are important because browsers come with a list of trusted CAs—only certificates signed by these authorities are automatically trusted. Popular CAs include Let's Encrypt (free), DigiCert, Comodo, and GlobalSign.
Why do browsers show 'Not Secure' warnings on HTTP sites?
Browsers warn users because HTTP traffic can be intercepted, read, or modified by attackers on the network. This is especially dangerous for passwords, credit cards, or personal data. Modern browsers mark all HTTP pages as 'Not Secure' and block certain features (like geolocation and service workers) on non-HTTPS sites.
How can I get a free HTTPS certificate for my website?
Let's Encrypt provides free, automated TLS certificates trusted by all major browsers. Many hosting providers offer one-click Let's Encrypt integration. Cloudflare also offers free SSL certificates. These certificates are valid for 90 days and can be auto-renewed. For most websites, free certificates provide the same security as paid ones.