HTTPS (HTTP Secure) is HTTP traffic encrypted inside a TLS session, protecting data confidentiality, integrity, and server authenticity between a client and a web server.

What is HTTPS? Definition, examples and how it works

HTTPS (HTTP Secure) is the secure version of HTTP, defined in RFC 2818 (2000) and later superseded by RFC 7230. It wraps standard HTTP requests and responses inside a Transport Layer Security (TLS) session, typically on TCP port 443. The protocol provides three critical security properties: encryption to prevent eavesdropping, integrity verification to detect tampering, and server authentication via X.509 certificates to confirm the server's identity.

When a client connects to an HTTPS URL (https://), it first performs a TLS handshake with the server. During this handshake, the server presents a digital certificate signed by a trusted Certificate Authority (CA). The client verifies the certificate's validity, then negotiates a symmetric session key using public-key cryptography. Once the TLS tunnel is established, the client and server exchange plain HTTP messages through that encrypted channel. The actual HTTP semantics (methods, headers, status codes) remain unchanged.

HTTPS is now the default for web traffic, with major browsers marking plain HTTP as insecure. It protects login credentials, payment details, and API tokens from interception on untrusted networks. The protocol has evolved through TLS versions 1.0 through 1.3 (RFC 8446, 2018), with older versions deprecated due to vulnerabilities. HTTPS also underpins HTTP/2 (RFC 7540) and HTTP/3 (RFC 9114), which require encryption. Adoption is measured by services like Let's Encrypt, a free CA that has issued over 300 million certificates as of 2024.

Key facts

Operates on TCP port 443 by default, versus port 80 for plain HTTP.
Uses TLS (formerly SSL) for encryption, with TLS 1.3 (RFC 8446) as the current standard.
Server identity is verified through X.509 certificates issued by trusted Certificate Authorities.
First standardized in RFC 2818 (2000), later updated by RFC 7230 and RFC 9110.
Required for HTTP/2 and HTTP/3; major browsers deprecate plain HTTP for new features.

How it works in practice

When you visit https://www.example.com, your browser connects to port 443 and initiates a TLS handshake. The server sends its certificate, which your browser validates against a built-in list of trusted CAs. A symmetric key is derived, and all subsequent HTTP data (including POST form submissions, cookies, and response bodies) is encrypted. An attacker on the same Wi-Fi network can see only encrypted packets, not the contents of the request or response.

Related terms

TLS HTTP SSL Certificate Authority HTTP/2 HTTP/3 Let's Encrypt

References

More in Web Protocols

CORS

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that lets servers explicitly allow web pages from one origin to request resources from a different origin via HTTP response headers.

GraphQL

GraphQL is a query language and runtime for APIs that lets clients request exactly the data they need in a single round trip, reducing over-fetching and under-fetching.

gRPC

gRPC is a high-performance, open-source remote procedure call framework initially developed by Google. It uses HTTP/2 for transport, Protocol Buffers as its interface definition language and message serialization format, and supports bidirectional streaming.

HTTP

HTTP is a text-based request-response protocol that defines how web clients and servers exchange resources, forming the foundation of data communication on the World Wide Web.

HTTP Pipelining

HTTP Pipelining is a technique in HTTP/1.1 that sends multiple requests on a single connection without waiting for each response, now largely replaced by HTTP/2 multiplexing.

HTTP Status Code

A three-digit integer in an HTTP response that indicates the result of the server's attempt to process the request, grouped into five classes (1xx through 5xx).

HTTP/1.1

HTTP/1.1 is the persistent-connection version of the Hypertext Transfer Protocol, defined in RFC 2616 and updated by RFCs 7230-7235, enabling multiple requests and responses over a single TCP connection.

HTTP/2

HTTP/2 is a binary, multiplexed version of HTTP that reduces latency through header compression, stream prioritization, and server push, as defined in RFC 7540.

HTTP/3

HTTP/3 is the third major version of the Hypertext Transfer Protocol, which runs over QUIC instead of TCP to reduce latency, eliminate head-of-line blocking, and improve connection setup time.

Keep-Alive

Keep-Alive, also called persistent connection, allows multiple HTTP requests and responses over a single TCP connection, reducing latency and overhead compared to opening a new connection per request.