How HTTPS keeps your password secret

You type your password on a website and press Enter. On its way to the server, it passes through your Wi-Fi, your internet provider and other networks.

Without HTTPS, anyone along the way could read it, because it would travel as plain text.

With HTTPS, the browser first checks who it is talking to. The server shows a certificate. A trusted company has signed it to confirm who owns the website.

Then the browser and the server agree on a secret key. They do this in the open, with math that someone listening can’t undo, so nobody else ends up with the key.

Now the browser uses the key to scramble your password before it sends it. Anyone in between only sees scrambled data. The server uses the same key to turn it back into your password.

People on the same network can often still see which website you visit. They can’t see the pages or what you type.

So before you type a password, check that the address starts with https.