We have covered the topic of HTTP, how it works, and what it is used for, but in modern browsers, you might notice a prefix at the start of each link: HTTPS.

The main difference between these protocols is that one has an 'S' at the end, which stands for 'Secure'. This means HTTPS provides greater security.

Previously, all websites used HTTP, which did not provide a secure connection and transmitted data in an unencrypted form. This made them vulnerable, as the data could be intercepted and read before the intended information reached its recipient.

Later, HTTPS was developed, which adds an extra layer of security by encrypting data using SSL/TLS (Secure Sockets Layer / Transport Layer Security), which are protocols that keep your information safe while it's being sent over the internet.

In simple terms, SSL/TLS creates a secure connection between your computer and the website you’re visiting. This helps protect your data from being intercepted or altered by others, making HTTPS the standard for ensuring security online.

Real Life Example

Imagine you are sending a letter through regular mail. If you use HTTP, it is like sending a postcard: anyone who intercepts or sees it along the way can read what is written. All the information is visible and accessible to everyone.

Now, if you use HTTPS, it is similar to sending a letter in a sealed envelope with tamper-evident protection. Only the sender and the recipient know what is inside, and if anyone tries to tamper with the envelope along the way, it will be immediately noticeable, keeping the information secure.

How does HTTPS Work?

The HTTPS protocol involves a process where, upon establishing a connection, the client and server agree to use a temporary key to encrypt and decrypt messages.

The essence lies in using a pair of keys: one key is used for encrypting messages (public key), while the other is used for decrypting them (private key).

Both keys belong to the same party, in this case, the server. The private key is kept secret, while the public key can be freely shared with clients. The clients use this public key to encrypt messages, which are then sent to the server.

In this setup, the client sends information to the server that has been encrypted with the public key. The server possesses the private key, which can decrypt this information and retrieve the data.

Even if someone intercepts the traffic and obtains this information, they will not be able to do anything with it because it is encrypted. To decrypt it, they would need the private key, which is stored on the server and has not been shared with anyone.