How does HTTPS differ from HTTP?

#1. The basic difference

Put simply: HTTPS = HTTP + encryption + authentication + integrity protection.

#2. What HTTP is

HTTP is a simple text protocol for exchanging data between a client (browser, application) and a server. When you send a GET / request, the browser sends it over the network in the open, and the server replies with text.

Example (as "raw" data):

Response:

The downside: everything is sent in plain text, including passwords, cookies, and tokens, anyone who intercepts the traffic (say, over Wi-Fi) can read or tamper with the data.

#3. What HTTPS adds

HTTPS uses TLS (Transport Layer Security), a layer between TCP and HTTP, which:

• encrypts the data being transmitted (no one can read it);
• authenticates the server (a guarantee that you're talking to the real site);
• verifies the integrity of the data (no one tampered with the message along the way).

#4. How HTTPS works (in 3 steps)

1. The client connects to the server on port 443 and says, "I want to establish a secure connection."
2. The server sends its TLS certificate, issued by a trusted authority (CA).
3. The TLS handshake:

• the client verifies the certificate,
• both sides agree on encryption algorithms,
• they create a shared session key,
• from now on all traffic is encrypted with that key.

From then on, HTTP requests travel inside the encrypted TLS tunnel. Outside observers can only see that you're connected to the site, not what you're actually sending.

#5. Why a certificate is needed

An SSL/TLS certificate:

• confirms that the site is genuine (issued by a trusted authority, e.g. Let's Encrypt);
• contains the public key used to establish a secure channel;
• has an expiration date (typically 90 days or 1 year).

Without a certificate, browsers:

• show a red "Not secure" warning;
• can block access to the site.

#6. Why HTTPS is the standard today

• Protecting logins, passwords, payments, tokens, and cookies.
• SEO: Google ranks sites without HTTPS lower.
• Modern APIs, Service Workers, PWAs, all require HTTPS.
• All browsers default to https://.

#7. An analogy

HTTP is a postcard, anyone at the post office can read it. HTTPS is a sealed envelope, only the recipient can open it and see what's inside.

#8. Technically

#9. What this looks like in Node.js

• An HTTP server:

  javascript

  Copy

  import http from 'node:http'; http.createServer((req, res) => res.end('Hello HTTP')).listen(80);

• An HTTPS server:

  javascript

  Copy

  import https from 'node:https'; import fs from 'node:fs'; const options = { key: fs.readFileSync('key.pem'), cert: fs.readFileSync('cert.pem'), }; https.createServer(options, (req, res) => { res.end('Hello HTTPS'); }).listen(443);

#10. In short

HTTP sends data as plain text. HTTPS uses encryption (TLS) and a certificate for secure transmission.

Today HTTPS is a mandatory standard: it protects users, builds trust, improves SEO, and secures the whole web infrastructure.