HTTPS

HTTPS is HTTP sent over a connection protected by TLS. It provides encryption in transit, integrity checks and verification of the server's identity through a certificate.

Simplified: during the handshake the client verifies the certificate and agrees session keys with the server. Application data is then protected with fast symmetric encryption.

Example: someone eavesdropping on Wi-Fi shouldn't be able to read a login form's contents.

Pitfall: HTTPS doesn't prove a site is honest, and it doesn't fix XSS, broken authorisation or weak passwords. It protects data in transit, not everywhere the data is stored.