What HTTPS protects: Free Lesson

Checking payslips on café Wi-Fi

You sit in a café and open the payroll site on its free Wi-Fi. Anybody else on that network can watch the messages go past.

What can they read? Your password? The amount on your payslip? The name of the site? The answer depends on one letter in the address: the s in https.

By the end of this lesson

Note

I can explain what HTTPS protects.

Key words

Word	What it means
HTTP	the rules browsers and web servers use to talk
HTTPS	HTTP sent inside an encrypted connection
Encryption	scrambling a message so only the right end can read it
TLS	the system that encrypts the connection for HTTPS
Certificate	a signed file that proves a server's name
Certificate authority	a company browsers trust to sign certificates

The cells students fill in are left blank in this preview.

An HTTP request is plain text

When your browser asks for a page, it sends a short text message. The first line says what it wants. The next lines add details, such as the site's name and a cookie.

A cookie is a small value the site gave you earlier. It often proves you are logged in.

The server answers with a status code, such as 200 for OK or 404 for not found. Over plain HTTP, all of this can be read on the way.

Try it: a request and a reply

Code: python

# An HTTP request is plain text. This is what a browser sends.
request = "GET /orders/1042 HTTP/1.1\n"
request = request + "Host: shop.example.com\n"
request = request + "Cookie: session=7f3a9c\n"

print(request)

# The server answers with a status code. Some you will see at work:
meanings = {200: "OK", 301: "Moved", 404: "Not found", 500: "Server error"}
code = 404
print(code, meanings[code])

# Change code to 500, then press Run.

HTTPS hides the contents, not the trip

With HTTPS, the browser and server first set up a TLS connection. Everything inside it is encrypted.

So the page, the cookie, your password and the full address after the site name are hidden. Somebody watching still sees which server you connect to and roughly how much you send. They can usually see the site's name too.

Worked example: what the café can see

Part of the request	Over HTTP	Over HTTPS
The password you type	Visible	Hidden
Your session cookie	Visible	Hidden
The page, like /payslips/october	Visible	Hidden
The site name, payroll.example.com	Visible	Usually visible
The server's IP address	Visible	Visible

The cells students fill in are left blank in this preview.

A certificate proves the name

Encryption is no use if you are talking to the wrong server. So the server shows a certificate. It names the site, has an end date, and is signed by a certificate authority your browser trusts.

The browser checks all three. If one fails, it shows a full-page warning. Below is what curl -v printed for a real check. Look for the name and the dates.

Real output from curl -v

Code: bash

$ curl -v https://shop.example.com/
*   Trying 203.0.113.10:443...
* Connected to shop.example.com (203.0.113.10) port 443
* SSL connection using TLSv1.3
* Server certificate:
*  subject: CN=shop.example.com
*  start date: Sep  1 00:00:00 2026 GMT
*  expire date: Nov 30 23:59:59 2026 GMT
*  issuer: C=GB; O=Example Trust; CN=Example Trust CA
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: shop.example.com

A common mistake

Warning

Many people think the padlock means a site is safe to trust. The padlock means the connection is private and the certificate matches the name. A scam site can buy a certificate too. Check the name in the address bar, not only the padlock.