What Is HTTPS and How Is It Different From HTTP?
HTTPS is plain HTTP carried inside a protected channel. It is what the padlock in the address bar stands for, and what the "Not secure" warning marks the absence of. Here is what HTTPS is, how it differs from HTTP, and where the certificate comes from.
What HTTPS adds
The S is for secure. HTTPS changes none of the methods, status codes or request structure — it wraps ordinary HTTP in a TLS layer that provides three things.
- Encryption. Nobody along the way can read the contents: not the page URLs, not form data, not cookies. All that is visible is which domain you connected to.
- Integrity. Responses cannot be quietly altered in transit — no injected ads, no swapped downloads. Any modification breaks verification.
- Authenticity. You are talking to the site whose address is in the bar, not an impostor. That is what the certificate is for.
How it differs from HTTP
| HTTP | HTTPS | |
|---|---|---|
| Encryption | None, clear text | Yes, TLS |
| Tamper protection | None | Yes |
| Site identity check | None | Certificate |
| Standard port | 80 | 443 |
| Browser label | "Not secure" | Padlock |
| Camera, microphone, geolocation | Blocked | Available |
| Service workers, PWAs | Do not work | Work |
| Search ranking | Worse | Better |
Note the camera and service worker rows: those are not recommendations but hard browser restrictions. A whole set of APIs is only available in a secure context — meaning over HTTPS. The one exception is localhost itself, which browsers treat as trusted. That is why a PWA works locally and stops working the moment you open the same site from your phone over an IP address.
What a certificate is
A certificate is a file vouching that a given domain belongs to whoever runs it. It is issued by a certificate authority (CA) — an organisation browsers trust by default, Let's Encrypt being the best-known.
What happens when you connect:
- The browser asks the server for its certificate.
- It checks the CA's signature, the expiry date, and that the domain in the certificate matches the address bar.
- If everything lines up, it shows the padlock and sets up the encrypted connection.
Any mismatch — expired, issued for a different domain, signed by somebody unknown — and the browser throws up a full-page warning.
Why a self-signed certificate does not help
You can issue a certificate yourself in a minute, and it will be technically valid: encryption works fine. But it is signed by you rather than a trusted authority, and the browser has no way to verify that you are who you claim. The result is "Your connection is not private", a "Proceed anyway" button, and irritated testers.
That is also where mkcert and other local CAs come in: they add your certificate to the trust store on your machine. Your client's phone has no such trust.
HTTPS does not mean "this site is safe"
The padlock says exactly one thing: the channel is encrypted and the domain is verified. It makes no promise that the site is honest, stores your data responsibly, or is not running a scam. Phishing sites get valid certificates just as easily — HTTPS is present, trust is not warranted.
FAQ
Does HTTPS slow a site down? Barely. The TLS handshake adds a little to connection setup, but HTTPS unlocks HTTP/2 and HTTP/3, which are usually faster overall.
Is SSL something different? Historically yes: SSL is the long-obsolete predecessor of TLS. People still say "SSL certificate" out of habit while meaning TLS.
Do certificates need renewing? Yes, they have a limited lifetime. Free Let's Encrypt certificates last 90 days and are usually renewed automatically.
Why does my site show "Not secure"? Either there is no certificate, or it has expired, or it was issued for a different domain, or an HTTPS page is pulling some resources over HTTP.
Getting HTTPS for a local site
There is no need to issue and renew certificates just for local development. A tunnel publishes your localhost over HTTPS with a valid certificate straight away, while your application keeps serving plain HTTP and never learns about the encryption. How to switch it on is in How to share localhost over HTTPS.
Related: what is HTTP · what is TCP