What Is TLS/SSL Encryption? The Padlock That Protects Every Site You Visit
✦ Key takeaways
- TLS is the modern, secure successor to SSL; the old name just stuck around.
- Encryption scrambles your data into code only the site you connect to can read.
- The 'handshake' verifies the site's identity via a certificate and agrees on keys.
- HTTPS = HTTP + TLS; it protects data in transit but doesn't guarantee the site itself is honest.
Every time you see a small padlock next to a web address, or the address starting with https, you are benefiting from a technology called TLS. It is the invisible layer that protects your passwords, card numbers and messages from eavesdropping as they travel between your device and the website. Without it, anyone on the same network (like a café Wi-Fi) could read everything you send.
SSL or TLS? The difference in a word
SSL (Secure Sockets Layer) is the original, old protocol. It evolved into TLS (Transport Layer Security), the modern, secure version used today. Old SSL versions have vulnerabilities and are no longer used. But the name 'SSL' stuck out of habit, so people say 'SSL certificate' while the actual technology behind it is TLS.
Invoice & Quotation Maker
Professional invoices that auto-calc & print/PDF in a minute.
What does encryption actually do?
Encryption turns your readable data (like 'my password is 12345') into a random-looking string that means nothing to an eavesdropper. The key that unlocks it exists only at the two ends of the connection: your device and the website. If someone intercepts the data in transit, they see code they can't understand.
The handshake: how a secure connection begins
Before any sensitive data moves, your device and the server agree, in a fast process called the handshake, on three essential steps:
| Step | What happens | Why it matters |
|---|---|---|
| Verify identity | The server presents a certificate signed by a trusted authority | You confirm you're talking to the real site, not an impersonator |
| Agree on keys | Both sides generate secret session encryption keys | No one else holds these keys |
| Start encrypting | Everything after is encrypted with those keys | Data is protected for the whole session |
The certificate is the point of trust: it is issued by a Certificate Authority after verifying domain ownership, and your browser shows a scary warning if the certificate is expired or untrusted.
What TLS protects — and what it doesn't
TLS protects you from eavesdropping (reading your data in transit), tampering (altering content on the way), and basic impersonation (confirming you're on the right domain). But beware: the padlock does not mean the site itself is honest or safe. A scam site can also obtain a valid TLS certificate; the padlock confirms your connection to this site is encrypted, not that this site is trustworthy.
Tip: always check the domain name itself, not just the presence of a padlock. Scammers exploit blind trust in the 'green lock.'
In short, TLS is the silent backbone of internet security: it makes shopping, banking and messaging over the web safe, through strong encryption that begins with a quick handshake you barely notice.