HTTPS
/ spelled out: H-T-T-P-S /
HTTP is the language browsers and web servers speak to exchange pages — but plain HTTP sends everything in the clear, like shouting your messages across a room. HTTPS is simply HTTP spoken inside the sealed, verified TLS pipe. The 's' stands for secure, and it's the difference between the padlock icon and the 'Not Secure' warning in your address bar. Nothing about the web requests themselves changes; they just travel encrypted and authenticated instead of exposed.
Mechanically, HTTPS is HTTP layered on top of TLS, which in turn runs over TCP (typically on TCP port 443, versus 80 for plain HTTP). When you connect, TLS does its handshake first — verifying the server's certificate and agreeing on a session key — and only then does your browser send the ordinary HTTP request (the GET, the headers, the form data) through that encrypted channel. The server's HTTP response comes back the same way. To the HTTP layer it's business as usual; TLS underneath quietly handles confidentiality, integrity, and server authentication.
Why it matters and its honest limits: HTTPS protects you from eavesdroppers reading your traffic and from a man-in-the-middle altering pages or stealing logins, and it's now the default for essentially the whole web. But be clear about what the padlock does and does not mean. It means your connection to the named site is encrypted and that you're really talking to whoever controls that domain. It does NOT mean the site is honest, safe, or reputable — scam and malware sites routinely use HTTPS. It also doesn't hide which site you visited (the domain name and your traffic patterns are still observable). HTTPS secures the journey; it doesn't vet the destination.
You type a password on https://mail.example. Because it's HTTPS, the password is encrypted inside TLS before leaving your device; a sniffer on the Wi-Fi sees only ciphertext. On plain http://mail.example the same password would scroll past in readable text — which is why browsers now flag HTTP login forms as 'Not Secure.'
Same HTTP request, now inside an encrypted TLS pipe.
The padlock is not a trust badge. HTTPS proves your channel to a named domain is encrypted and authenticated — not that the site is legitimate. Phishing and malware sites use HTTPS too; treat it as 'private,' not 'safe.'