What the Padlock Promises, and What It Does Not
The padlock means the connection is private. It does not mean the site is safe, honest, or who you think. Three misreadings, and the real guarantee underneath.
There is a padlock, so the site is secure. That is what it means, isn't it?
It means one specific, valuable thing — and three other things people hear that it never said. Phishing sites have padlocks too. Let us separate the promise from the wishful thinking.
The one real promise
The padlock means HTTPSTLSThe encryption behind the padlock — it scrambles the contents of a page between your device and the site so nobody in between can read it. is in use: the connection between your browser and this server is encrypted, and nobody on the path — your ISPISPYour internet service provider — the company whose wire or signal you use to reach the internet, and which can see every site you connect to., the café Wi-Fi, someone between — can read or alter what passes. That is genuine and important. It is also the entire promise.
Padlock guarantees:
1. The traffic to this server is encrypted (private in transit)
2. It reached the server the certificate is for (not silently redirected)
Padlock does NOT guarantee:
3. The site is honest, safe, or not a scam
4. The company behind it is who the name suggests
5. What the site does with your data once it has it
- Line 2Real and worth having: on hostile Wi-Fi this is exactly what stops someone reading your traffic.
- Line 7A phishing page can hold a valid certificate for its own lookalike domain. The padlock is green; the site is a trap.
You land on paypa1-secure.example — note the digit "1" — and it shows a padlock. Is your money safe?
Which of these does the HTTPS padlock actually guarantee?
So how do you judge the site itself?
Trusting the padlock
- "It has a padlock, so I will log in"
- Skimming the domain, seeing the brand word somewhere in it
- Following a link from an email straight into typing a passwordReading the address
- Read the domain right-to-left: the real name is just left of the final
.com / .org — paypal.com.evil.example is evil.example
- Reach important sites by a saved bookmark, not a link you were sent
- Treat "urgent, verify now" as the tell it almost always isThe padlock secures the road. Reading the domain tells you whose building you arrived at. You need both, and only one of them is automatic.
# the important part is the label just before the final dot-suffix
https://accounts.google.com/signin -> google.com (real)
https://google.com.account-verify.example -> account-verify.example (not)
https://xn--80ak6aa92e.example -> punycode; look twice, letters can lie
So the padlock is necessary but nowhere near sufficient.
Precisely. No padlock on a page asking for a password is a hard stop. A padlock present is the beginning of your checking, not the end of it.
And the good news: HTTPS is now the default across the web, quietly doing its real job. Your attention is better spent on the address bar, which is the part no certificate can vouch for.
Legal
This teaches you to read connection security and site identity to protect yourself. Setting up lookalike domains or certificates to deceive others is fraud and squarely outside this course.
So the padlock keeps your connection private and untampered — believe it for exactly that, and no more. Whether the site deserves your password is a separate judgement you make from the domain name and your own caution. Match it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: against a network eavesdropper the padlock is the win; against a phisher it is irrelevant and the address bar is everything. That closes The Browser. Next course, we leave the browser for the operating system underneath it.