Mobile Networking · Encryption in Transit · Lesson 1 of 4

HTTPS & the Padlock

See how HTTPS protects a connection and what the padlock does and doesn't promise.

Inside an HTTPS Connection

When an address starts with https://, your browser and the website set up a protected connection before any page data moves. The protection comes from TLS (Transport Layer Security), the same encryption that made the packet payload look like gibberish in Course 1. HTTPS normally uses port 443.

Setting up that connection is called the TLS handshake. The site sends its certificate, a digital ID that proves it really owns the name in the address bar. Your browser checks it, and the two sides agree on fresh encryption keys for this visit.

Browsers show the result next to the address. Many show a padlock. Chrome replaced its padlock with a small settings-style icon in 2023, since HTTPS is now normal, and other browsers have changed their icons over the years too. Tapping the icon still opens the connection and certificate details.

On the simulated phone, open https://bank.example and tap the padlock to read the certificate. Then switch on Café Wi-Fi with an attacker, reload, and check who issued the certificate this time.

What the Padlock Promises

HTTPS protects what travels between your phone and the site. Anyone on the path, such as the café Wi-Fi owner or your mobile carrier, can't read it or quietly change it. That covers the page itself, the full address after the domain, anything you type into forms, and cookies.

Some things stay visible. The domain name usually leaks through the DNS lookup and through a handshake field called Server Name Indication (SNI). Observers can also see when you connected and roughly how much data moved. Course 3 shows this from the observer's side.

The padlock has a limit people often miss. It means the connection is encrypted and the certificate matches the name in the address bar. It says nothing about whether the site is honest. Certificates are cheap or free, so scam sites use HTTPS too. A fake login page at bank-login.example can show a padlock as easily as the real bank. Google's research found many people misread the padlock this way, which was one reason Chrome changed the icon.

So check the domain name itself, every time.