SSL vs TLS vs HTTPS: How the Padlock Actually Works

0:00The Postcard

Every time you type a password into a website, it takes a trip — through your router, your internet provider, and a chain of machines you have never met. Plain HTTP sends it as a postcard. Every machine along the path can read it — and worse, any of them can rewrite the page you get back: swap a download, plant a scam. That is why browsers are now preparing to treat every unencrypted site as a threat. The fix is a tunnel, built in milliseconds, before a single byte of the page moves. It is called TLS. And it starts with a handshake.

0:37The Names on the Door

First, the names — because the industry never cleaned them up. SSL is the original: built at Netscape in the nineties, broken beyond repair, and formally banned — the standard says SSL version three must not be used. Its replacement arrived in 1999 under a new name: TLS — transport layer security. That is the protocol actually running today. And HTTPS? Not a new protocol at all. It is plain HTTP, driven through a TLS tunnel. So when someone sells you an SSL certificate, smile politely. Everything modern is TLS — the old name just refuses to die.

1:25Two Kinds of Locks

To build the tunnel you need encryption, and encryption comes in two kinds. The first kind uses one shared key that locks and unlocks everything. Blazing fast — perfect for traffic. One problem: how do you hand your partner the key, over a wire everyone can read? That is where the second kind comes in. Public-key encryption splits the lock in two: a public half anyone can use to lock a message, and a private half — the only key that opens it. Powerful, but far too slow for a whole conversation. So TLS does the obvious thing. The slow kind runs once, just to agree on a fresh shared key. Then the fast kind takes over — and carries everything else.

2:19The Handshake

Here is the handshake itself — and in modern TLS it takes one round trip. The browser speaks first: here are the ciphers I can speak, and here is my half of a key we are about to build. The server answers with its own half — and at that instant, both sides can compute the same secret key, even though it never crossed the wire. From that reply onward, everything is already encrypted — even the rest of the handshake. Inside the tunnel, the server hands over its certificate — its ID card, really — plus a signed proof that it holds the matching private key. Both sides check that nothing was tampered with. Finished. Milliseconds, start to end — and only then does the page itself flow.

3:11The Chain of Trust

One hole remains. How does your browser know that certificate is real? Anyone can generate keys and claim to be your bank. So certificates are vouched for. The server's certificate is signed by a certificate authority. Your device ships with a short list of authorities it already trusts, and the signature has to chain up to one of them. Forge any link, and the chain snaps. Vouching used to cost real money — until Let's Encrypt started signing certificates for free, by the millions, every single day. Today it vouches for more than seven hundred million websites. Encryption stopped being a luxury. It became the default.

3:57What the Padlock Promises

Now the payoff — and a warning. The padlock makes exactly three promises: nobody read the traffic. Nobody changed it. And you are talking to the domain in the address bar. Look at that last one again — it does not promise the domain is honest. Free certificates armed everyone, including attackers: by 2020, more than eight in ten phishing sites already ran on perfectly valid HTTPS. The padlock says the line is private. It says nothing about who is on the other end. Meanwhile, the web finished encrypting — nearly every page you load — and from October 2026, Chrome will warn you before touching a plain HTTP site at all. The postcard era is over. Check the name on the door.