HTTP is the protocol browsers use to fetch web pages. HTTPS is the same protocol inside a TLS connection: the traffic is encrypted, and the server proves its identity with a certificate. HTTP uses port 80; HTTPS uses port 443.
How it works
What HTTPS adds
- Encryption: Wi-Fi operators, ISPs and anyone on the path can't read pages, form data, cookies or passwords.
- Integrity: nobody can inject ads or malware into the page in transit.
- Authentication: the certificate proves you're talking to the real domain, not an impostor.
What it doesn't hide
- The domain name you visit is usually visible (in DNS lookups and the TLS SNI field), though not the full URL.
- IP addresses of both ends.
- It says nothing about whether the site itself is trustworthy: phishing sites have valid certificates too.
Today
Nearly all web traffic is HTTPS. Browsers label HTTP pages “Not secure”, block mixed content, and many offer HTTPS-only modes. Certificates are free from Let's Encrypt and other CAs.
Side by side
| HTTP | HTTPS | |
|---|---|---|
| Default port | 80 | 443 |
| Encrypted | No | Yes (TLS) |
| Server verified | No | Yes, by certificate |
| Browser label | Not secure | Padlock / none |
| Visible on the network | Everything | Domain and IPs only |
| HTTP/2 and HTTP/3 | Not in browsers | Yes |
Examples
$ curl -sI http://apple.com | head -2
HTTP/1.1 301 Moved Permanently
Location: https://www.apple.com/
Most sites answer HTTP only to redirect to HTTPS, and HSTS tells browsers to skip the HTTP step next time.
On a Mac
Click the padlock in Safari's address bar › Show Certificate to see who issued a site's certificate. In Terminal, curl -v https://example.com 2>&1 | grep -E 'SSL|subject|issuer' shows the TLS version and certificate.
See it in the app
LightAtom's connections view shows which apps still connect to port 80, plain HTTP.
Frequently asked questions
What is the difference between HTTP and HTTPS?
HTTPS encrypts the connection with TLS and verifies the server with a certificate. HTTP sends everything as readable text.
Is HTTPS completely private?
Page contents are, but the domain you visit and the IP addresses are still visible to your network and ISP.
Does HTTPS mean a site is safe?
No. It means the connection is secure. Scam sites can and do use HTTPS.
Why does my browser say “Not secure”?
The page was loaded over HTTP, so anything you type could be read or changed on the way.