📖 Programmer's Bible
First Chapter: From Zero to Your Own Website › Part 2: The Network › 50 of 60 · See on the map

HTTPS and Encryption Basics

⏱ 6 min read

In one sentence: HTTPS is HTTP sent inside an encrypted connection, so that other people on the network cannot read or secretly change the messages between your browser and a website.

Why should I care?

Many web addresses start with https://, such as https://developer.mozilla.org. The extra S stands for Secure.

In HTTP, you saw that requests and responses are lines of text. With plain HTTP, they travel as they are. Chrome's help pages warn that on such a site, "someone may be able to view and change the information you send and get through this site".

Analogy

Think of sending a message by post.

  • HTTP is like a postcard. Anyone who handles it on the way can read it. Someone could even change the words.
  • HTTPS is like a letter in a locked box. Only you and the receiver have the key. People on the way cannot open it. If someone breaks the box, the receiver will notice.

Where the analogy breaks down: in HTTPS, the "lock" is mathematics, and a "key" is a number. Also, the two sides never meet to share a key. Your browser and the server agree on a secret key each time they connect, over the network itself, even if someone is listening. How this works is beyond this page.

How it actually works

What encryption means

MDN, a website that documents how the web works, calls cryptography "the science that studies how to encode and transmit messages securely". Encryption turns a readable message (plaintext) into scrambled text (ciphertext). Decryption turns it back. The method is called a cipher.

An old example is the Caesar cipher, named after Julius Caesar, who used it in his private letters. You move each letter a fixed number of places in the alphabet. With a move of 3, A becomes D, so HELLO becomes KHOOR. The number 3 is the key: the secret you need to scramble and unscramble.

It is weak: with the English alphabet there are only 25 possible moves, so an attacker can try them all. MDN says the cipher is often public, so the key must stay secret. Without the key, decryption is "mathematically hard to perform".

Two kinds of keys

  • One shared secret key locks and unlocks. MDN calls this symmetric-key cryptography ("symmetric" means the same on both sides). It is "highly efficient".
  • A pair of keys: a public key that anyone may have, and a private key that only its owner keeps secret. What one key locks, only the other can unlock. This is public-key cryptography. MDN says it is usually much slower.

A key pair can also make a digital signature. MDN explains: the owner uses the private key to sign, and anyone can use the public key to check. Only the owner of the private key could have made that signature.

In HTTPS, key pairs help prove who the server is, and help both sides agree on a shared secret key. Then the fast shared key encrypts the messages.

TLS: the protocol that adds the S

MDN says HTTPS uses a protocol called TLS (Transport Layer Security) to encrypt all communication. TLS starts with a handshake: setup messages sent before any HTTP message. In the handshake, the two sides agree on which TLS version and ciphers to use, the server sends its certificate, and they agree on a secret key.

The TLS handshake, then encrypted HTTP (simplified)A browser and a server. First they exchange handshake messages. The browser says hello and asks which TLS version and ciphers to use. The server answers and sends its certificate. The browser checks the certificate, and both sides agree on a secret key. After that, the HTTP request and the HTTP response travel between them encrypted.ServerBrowser(client)Handshake (setup)3. Checksthecertificate4. Both sides agreeon a secret keyAfter thehandshake:encrypted1. Hello: which TLSversion and ciphers?2. Answer, and theserver's certificate5. Encrypted HTTPrequest6. Encrypted HTTPresponse

(This order is simplified.) After the handshake, MDN says, the two sides use the secret key to encrypt "any messages, including HTTP headers as well as bodies".

The 2018 official description of TLS 1.3 lists what it protects:

  1. Confidentiality: after setup, the data "is only visible to the endpoints": your browser and the server.
  2. Integrity: the data "cannot be modified by attackers without detection".
  3. Authentication: the server always proves who it is.

They should hold even against "an attacker who has complete control of the network".

Certificates: proving who the server is

How does your browser know it reached the real website? The server sends a digital certificate. It contains the server's public key and the website's name, such as developer.mozilla.org. This lets the browser know "that it really is connecting to" that site, MDN says.

A certificate authority (CA) is an organization that signs certificates. Its digital signature says that the information is correct. Browsers come with a built-in list of trusted certificates, called root certificates. The website's certificate must be signed by a CA that a root certificate's owner trusts, directly or through other CAs. If something is wrong, Chrome may show a full-page error, "Your connection is not private". Its help pages say this means "a problem with the site, the network, or your device".

How it came to be

Before TLS came SSL (Secure Sockets Layer). MDN says the company Netscape released SSL version 3.0 in 1996.

  • January 1999: TLS 1.0 was published as RFC 2246. It says it is based on SSL 3.0. (RFCs are numbered internet documents.)
  • May 2000: RFC 2818, "HTTP Over TLS", described the https way of writing web addresses.
  • August 2018: TLS 1.3 was published as RFC 8446. MDN says it is now the most widely used version.

Let's Encrypt, a nonprofit certificate authority, gives certificates for free.

🧪 Try it in your browser

You need a computer with a keyboard. These steps change nothing.

  1. Open MDN's page in a new tab: developer.mozilla.org/en-US/docs/Web/HTTP.
  2. Open the security details:
    • Chrome: press Ctrl + Shift + J (Mac: Cmd + Option + J). Then press Ctrl + Shift + P (Mac: Cmd + Shift + P). A box for typing commands opens. Type privacy, select Show privacy and security, and press Enter. In the panel that opens, go to Security, then Overview.
    • Edge: press Ctrl + Shift + I (Mac: Cmd + Option + I). Click the Security tab. If you do not see it, click the More tools button and choose Security.
    • Firefox: press Ctrl + Shift + E (Mac: Cmd + Option + E). Reload the page. Click the first row, then the Security tab in the panel that opens.
  3. What you should see: in Chrome and Edge, the overview does not show the warning "This page is not secure". Click the View certificate button. Look for the website's name and the certificate authority that signed it. In Firefox, the Security tab shows the protocol, such as TLS 1.3 or TLS 1.2, and the certificate details.
  4. Close the certificate window, then close the tab.

Common misunderstandings

  • "HTTPS means the website is honest." No. HTTPS protects the connection. Microsoft warns that "even websites with valid certificates may have a poor reputation". Check that the name in the address bar is the website you meant to visit.
  • "Encrypted means nobody can read my data." Not quite. The website you send it to can read it. Encryption stops people on the way.

Recap

  • Encryption turns readable text into unreadable text with a cipher and a secret key. Only someone with the right key can turn it back.
  • HTTPS is HTTP inside TLS. A handshake checks the server's certificate and sets up a secret key. After that, every message is encrypted.
  • HTTPS keeps messages private and unchanged on the way, and proves which website you reached. It does not prove that the website is honest.

Sources

Written with AI · Reviewed by AI · Not yet checked by a human

Found a mistake, or something you did not understand? Report a problem.