HTTPS is HTTP sent over a connection protected by Transport Layer Security (TLS). TLS helps provide confidentiality and integrity, and helps the browser verify that it is communicating with a server authorized for the requested domain.
Certificates help establish identity
During a TLS handshake, the server presents a digital certificate. The browser checks that the certificate is valid, trusted, and matches the domain. A certificate does not mean a website is honest; it helps verify the connection is to the domain named in the address bar.
The connection is encrypted
The handshake allows the browser and server to agree on cryptographic keys. After setup, they use encryption to protect application data from being casually read in transit and integrity checks to help detect modification.
What HTTPS does not guarantee
HTTPS does not make a malicious website safe, protect a compromised device, or prevent every kind of tracking. It protects the connection between endpoints, not every action those endpoints take.
When building a site, use HTTPS everywhere, keep certificates current, and avoid mixing secure pages with insecure resources. Browsers rely on these signals to help people understand whether their connection is protected.