The short answer
HTTPS is HTTP with a layer of encryption on top. The S stands for secure, and it means the connection between your browser and the website is encrypted — so nobody in between can read or tamper with what you send.
Why it matters
On a plain HTTP site, everything you type is sent as readable text. Anyone on the same network — a coffee-shop Wi-Fi operator, an internet provider, a snoop — can, in principle, see it. That's a problem for passwords, payment details, and private messages.
HTTPS fixes that by encrypting the connection end-to-end.
How it works, briefly
- Your browser asks the site for its certificate — a digital ID that proves who it is.
- The certificate is issued by a trusted authority (a certificate authority).
- Your browser and the site agree on encryption keys using TLS (Transport Layer Security).
- From then on, everything is encrypted and can only be read by the two endpoints.
How to check a site is secure
Look at the address bar. A padlock icon (and a URL starting with https://) means the connection is encrypted. Modern browsers also warn you before sending data over plain HTTP.
The takeaway
Never enter a password or payment details on a site that isn't using HTTPS. The S is the difference between a private conversation and a postcard anyone can read.