How SSL & TLS Work — The Lock Behind Every HTTPS Website

When you open a website, you see a small lock icon in the address bar. SSL and TLS are the technologies behind that lock. They are encryption protocols that secure the data traveling between your browser and the server — so even if someone intercepts it mid-journey, they see nothing but unreadable gibberish.

Whenever you send a password, credit card number, or any sensitive data, TLS encrypts it first. This happens automatically, invisibly, in milliseconds — and you never notice it.

Before Data Moves, a Secret Is Agreed Upon

When you open https://srikanthbadavath.com, your browser and the server don't start sending data immediately. First they have a conversation — the TLS Handshake — to agree on a shared encryption key. Watch it happen live:

Your Password Becomes Unreadable Noise

Once the handshake completes, every byte you send is encrypted with the session key before it leaves your device. Type anything below and see what an attacker actually intercepts on the wire:

Without TLS, Anyone Between You and the Server Can Read Everything

Data on the internet travels through dozens of routers, ISPs, and networks before reaching its destination. On plain HTTP, every one of those hops can read and modify your data. This is the Man-in-the-Middle (MITM) attack.

With HTTPS (TLS), the attacker is still in the middle — they still see packets. But every packet is AES-256 encrypted. They see random noise they can never decrypt without the session key, which is never transmitted in the clear.

Why the "S" in HTTPS Changes Everything

Sites You Use Every Day — All Protected by TLS

Every time you log into Gmail, check out on Amazon, push code to GitHub, or open your bank — TLS is running silently in the background. Here's exactly what it's protecting on each:

How Your Browser Knows It's Talking to the Real Site

When a server sends its certificate, your browser doesn't just trust it blindly. It traces a chain of trust back to a Root Certificate Authority — an organisation your OS already trusts. Click "Verify Chain" to see it in action:

Public WiFi Without HTTPS — The Hacker's Favourite Place

You're at a coffee shop. You connect to "CoffeeShop_Free_WiFi". A hacker two tables away connects to the same router. On HTTP, they can see everything you send. On HTTPS, they're completely blind.

The 3 Security Checks Every Browser Runs Instantly

When you visit any HTTPS site, your browser silently runs three checks in milliseconds. Click a site below to see what it finds:

In Summary

The next time you see that small 🔒 in the address bar, you know exactly what happened in the 50 milliseconds before the page loaded — a four-step cryptographic handshake that made your connection private, authenticated, and tamper-proof.