What is the difference between HTTP and HTTPS?

HTTP is the protocol browsers use to request pages from servers, and it sends everything in plain text, meaning anyone positioned between you and the site, on the same Wi-Fi network, at an internet provider, or anywhere along the path, can read and modify the contents. HTTPS wraps the same protocol in TLS encryption, so the traffic is scrambled in transit and tampering is detectable. It also authenticates that you are connected to the server that holds a certificate for that domain name, which prevents an attacker from silently substituting their own server.

What HTTPS does not do is vouch for the site's intentions, and this is the most consequential misunderstanding. Certificates are available free and issued automatically, so a phishing site imitating your bank will display the padlock exactly as the real one does. The padlock means the connection is private, not that the destination is trustworthy. Browsers have gradually deemphasized the padlock icon for precisely this reason, since its presence was being read as an endorsement.

Two practical implications. HTTPS is now the default across the web, with browsers marking plain HTTP pages as not secure and increasingly attempting HTTPS first, so encountering an HTTP page today is unusual and worth noticing, particularly on any page asking for information. And the encryption covers the content of your traffic but not everything: the domain you are visiting is generally visible to your network and internet provider through DNS lookups and connection metadata, which is what encrypted DNS options and VPNs address. Enabling an HTTPS-only mode in your browser is a free setting that prevents accidental unencrypted connections, and it is worth turning on.