Syllabus Lesson 82 of 156 · Encryption you can explain
Encryption you can explain

What HTTPS hides and what it does not

Why it matters The padlock is the most trusted symbol on the web, and it is often misread. Knowing exactly what it protects tells you what your café Wi-Fi, your internet provider or your employer's network can still learn about you, and what your own site must still protect.

Think of HTTPS as a sealed, opaque envelope. The postal worker cannot read your letter. But they can still see the address on the outside, how thick the envelope is, and when you posted it.

HTTPS: HTTP (the language browsers and websites speak) sent inside an encrypted tunnel called TLS. The "S" stands for secure.

TLS: Transport Layer Security: the protocol that sets up the encrypted tunnel, using the public key then symmetric pattern from lesson 81. The setup step is called the handshake.

What HTTPS hides

Inside the envelope, out of sight of anyone on the network path:

  • The full address after the domain: on https://shopa.example/orders/2291?gift=yes, the path /orders/2291 and query ?gift=yes are hidden.
  • The page content, what you type into forms, and passwords.
  • Cookies and other headers, so a network watcher cannot copy your logged-in session.

It also proves who is on the other end. The site shows a certificate, which is its public key signed by an organisation your browser trusts. That stops someone on the network from quietly pretending to be shopa.example.

What HTTPS does not hide

The IP address. Your computer must send packets to the server's IP address, so anyone on the path sees which server you talk to. Many small sites share one IP behind a hosting company, which blurs this, but a large site with its own addresses is easy to recognise.

The domain name, through SNI. One server often hosts many sites, so at the very start of the handshake your browser says which site it wants, before encryption is running.

SNI: Server Name Indication: the field in the first handshake message that names the site you want, such as shopa.example. Traditionally it is sent in plain view.

The DNS lookup. Before connecting, your device asks "what is the IP address of shopa.example?" Unless that question is encrypted, the network sees it. Lesson 86 covers this.

Size and timing. How much data flows, and when. A watcher cannot read a page, but patterns of sizes can sometimes hint at what kind of page it was.

Encrypted Client Hello closes the SNI gap

Encrypted Client Hello (ECH): a newer TLS feature that encrypts the first handshake message, including the site name, using a public key the site publishes in its DNS records. The network only sees a shared outer name, such as the hosting provider's.

ECH is on by default in Chrome and Firefox, but it only works where the site publishes a special HTTPS record in DNS, and many sites do not do that yet (checked October 2026). On sites without it, the name still travels in plain view. And even with ECH, the IP address still leaks, and a site on its own dedicated addresses is still identifiable.

On the network pathPlain HTTPHTTPSHTTPS with ECH
Page content, forms, cookiesVisibleHiddenHidden
Path and queryVisibleHiddenHidden
Domain name (SNI)VisibleVisibleHidden
Server IP addressVisibleVisibleVisible
Sizes and timingVisibleVisibleVisible

A common misconception: "the padlock means the site is safe". The padlock means the connection is private and you are talking to the real owner of that domain. A scam site can have a padlock too. And once your data arrives, HTTPS has done its job: the site itself sees everything you send, and its trackers see what it shares with them.

Try it Click the icon to the left of the address on any HTTPS site and open the connection or certificate details. Find who issued the certificate and which domain it covers. Then look at the full address: everything after the domain is what HTTPS hides from the network.

Recap

  • HTTPS hides content, forms, cookies, and the path and query of every address.
  • It does not hide the server's IP address, sizes or timing.
  • The domain leaks through SNI, unless the site supports Encrypted Client Hello.
  • A padlock means a private connection to the real domain owner, not an honest site.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back