What the HTTPS Padlock Means — and What It Doesn't Tell You About a Site

You see a padlock or "https" in the address bar and take it as a sign that the site is safe. It means less than that: the connection between your browser and the site is encrypted, and the site's address matches its certificate. Who runs the site and whether it is honest, the padlock does not say — most phishing sites use HTTPS too. What protects you is reading the domain name itself.

What is happening

Encryption and integrity. HTTPS uses TLS to encrypt everything between your browser and the server (MDN). In the words of the Chromium team, the connection is a secure channel that "cannot be tampered with or eavesdropped on by third parties".

The certificate vouches for the address, not the owner. The browser checks that the site's address matches the one in its certificate and that the certificate is signed by an authority it trusts (CISA, US). The most common type, a domain-validated (DV) certificate, only proves control of the domain. Let's Encrypt issues them free of charge, and says such a certificate "says nothing else about a site's content or who runs it". Under the industry's rules (CA/Browser Forum), every certificate type gives the same assurance about the domain; a DV certificate contains only a country and the domain name.

The company name did not help either. Extended Validation (EV) certificates used to show a company name in the address bar. In 2019 Chrome moved it into the site details because "the EV UI does not protect users as intended"; Safari had dropped it in 2018, and Firefox followed in 2019, noting that EV certificates "with colliding entity names can be generated by choosing a different jurisdiction". In 2017 researcher Ian Carroll registered a company called "Stripe, Inc" in Kentucky and got a legitimate EV certificate for that name.

Scammers have padlocks too. By APWG's count, fewer than 5% of phishing sites used HTTPS at the end of 2016; by 2020–2021 it was more than four in five, and APWG has not published the figure since. In 2019 the FBI warned: "Do not trust a website just because it has a lock icon or 'https' in the browser address bar." The FTC (US) puts it plainly: the "s" means the site is encrypted, "but it doesn't mean it's a legitimate site".

Why the padlock is disappearing. In 2021 only 11% of participants in a Chrome study understood what the padlock meant. In Chrome 117 (September 2023) it was replaced with a "tune" settings icon on computers and Android, and removed on iOS; Google says the new icon "does not imply 'trustworthy'". Since Chrome 68 (2018), sites without HTTPS are marked "Not secure". Roughly 95–99% of Chrome page loads have used HTTPS since about 2020, and from Chrome 154 (October 2026) the browser will ask before opening a public site without it. Firefox turned its lock grey in 2019 and began showing a crossed-out lock on HTTP pages.

Certificates are not checked once for good. From 15 March 2026 a certificate can be valid for at most 200 days, shrinking to 47 days from 2029 (CA/Browser Forum).

What to do

Read the domain, not the icon. What counts is the name just before the first single slash: in bank.com.account-check.net the site is account-check.net. Chrome's own help says to check the site name even on a secure connection.
Watch for lookalikes. In 2017 a researcher showed that "аррӏе.com", spelled with Cyrillic letters, looked exactly like apple.com. Chrome now shows mixed-script addresses as punycode (starting with xn--) and puts up a full-page warning for addresses resembling well-known sites.
Use bookmarks for bank, email and government sites instead of links: bookmarks for banking, never click links to your bank. A link in an urgent email — check the sender first.
Stop at browser warnings. A red full-page screen means Google Safe Browsing has flagged the site as dangerous; "Your connection is not private" means a problem with the site, the network or your device. Clicking through is almost never worth it.
No passwords or card numbers on a page marked "Not secure", whatever icon your browser shows. The working test is three things together: the address starts with https, the domain is the one you meant, and there is no warning.
More on phishing: how to recognize phishing, malicious QR codes. Passkeys are harder to hand to a fake site than a password.

When this is not the case

A plain HTTP page that asks for nothing — an article, a timetable — is a lower risk. Chrome's "Not secure" warns that someone "may be able to view and change the information you send and get through this site"; if you send nothing, there is little to steal.
A lookalike domain gets a valid certificate just as easily. The padlock will be there; only the domain gives it away.
Public Wi-Fi. With almost all traffic encrypted, the realistic risk is being steered to a fake page rather than being overheard: turn off auto-join for public Wi-Fi, public Wi-Fi is not your friend.

Sources

Checked: 27 September 2026

What the HTTPS Padlock Means — and What It Doesn't Tell You About a Site

What is happening

What to do

When this is not the case

Sources

Digital

Living experience