Suggest an edit

Improve this article

Refine the answer for “How does HTTPS differ from HTTP?”. Your changes go to moderation before they’re published.

Approval required

Content

What you’re changing

Title (EN)

Short answer (EN)

Shown above the full answer for quick recall.

Answer (EN)

## 1. The basic difference

| Characteristic | **HTTP** | **HTTPS** |
|---|---|---|
| Stands for | HyperText Transfer Protocol | HyperText Transfer Protocol Secure |
| Security | Doesn't encrypt data | Encrypts data (TLS/SSL) |
| Default port | 80 | 443 |
| URL prefix | `http://` | `https://` |
| Certificate | Not required | An SSL/TLS certificate is required |
| Used for | Internal networks, testing, older sites | All modern sites and APIs |

> Put simply: **HTTPS = HTTP + encryption + authentication + integrity protection.**

## 2. What HTTP is

HTTP is a **simple text protocol** for exchanging data between a client (browser, application) and a server.
When you send a `GET /` request, the browser sends it over the network in the open, and the server replies with text.

Example (as "raw" data):

```javascript
GET /login HTTP/1.1
Host: example.com
```

Response:

```javascript
HTTP/1.1 200 OK
Content-Type: text/html
```

The downside: everything is sent **in plain text**, including passwords, cookies, and tokens, anyone who intercepts the traffic (say, over Wi-Fi) can read or tamper with the data.

## 3. What HTTPS adds

HTTPS uses **TLS (Transport Layer Security)**, a layer between TCP and HTTP,
which:

- **encrypts** the data being transmitted (no one can read it);
- **authenticates the server** (a guarantee that you're talking to the real site);
- **verifies the integrity** of the data (no one tampered with the message along the way).

## 4. How HTTPS works (in 3 steps)

1. **The client connects to the server** on port 443 and says, "I want to establish a secure connection."
2. **The server sends its TLS certificate**, issued by a trusted authority (CA).
3. **The TLS handshake:**
  - the client verifies the certificate,
  - both sides agree on encryption algorithms,
  - they create a shared session key,
  - from now on all traffic is encrypted with that key.

From then on, HTTP requests travel **inside** the encrypted TLS tunnel.
Outside observers can only see that you're connected to the site, not what you're actually sending.

## 5. Why a certificate is needed

An SSL/TLS certificate:

- confirms that the site is **genuine** (issued by a trusted authority, e.g. Let's Encrypt);
- contains the **public key** used to establish a secure channel;
- has an expiration date (typically 90 days or 1 year).

Without a certificate, browsers:

- show a red "Not secure" warning;
- can **block** access to the site.

## 6. Why HTTPS is the standard today

- Protecting logins, passwords, payments, tokens, and cookies.
- SEO: Google ranks sites without HTTPS lower.
- Modern APIs, Service Workers, PWAs, all require HTTPS.
- All browsers default to `https://`.

## 7. An analogy

> HTTP is a postcard, anyone at the post office can read it.
> HTTPS is a sealed envelope, only the recipient can open it and see what's inside.

## 8. Technically

| Component | HTTP | HTTPS |
|---|---|---|
| OSI layer | Application | Application (on top of TLS) |
| Port | 80 | 443 |
| Encryption | None | TLS (AES, RSA, ECDHE, etc.) |
| Integrity check | None | Yes (HMAC) |
| Performance | Faster (no encryption) | Slightly slower, but secure |
| Compatibility | All clients | All modern clients |

## 9. What this looks like in Node.js

- An HTTP server:

```javascript
  import http from 'node:http';
  http.createServer((req, res) => res.end('Hello HTTP')).listen(80);
  ```
- An HTTPS server:

```javascript
  import https from 'node:https';
  import fs from 'node:fs';

const options = {
    key: fs.readFileSync('key.pem'),
    cert: fs.readFileSync('cert.pem'),
  };

https.createServer(options, (req, res) => {
    res.end('Hello HTTPS');
  }).listen(443);
  ```

## 10. In short

> **HTTP** sends data as plain text.
> **HTTPS** uses encryption (TLS) and a certificate for secure transmission.
>
> Today HTTPS is a mandatory standard: it protects users, builds trust, improves SEO, and secures the whole web infrastructure.

Markdown · drag & drop images · ⌘B / ⌘I shortcuts652 words

For the reviewer

Note to the moderator (optional)

Visible only to the moderator. Helps review go faster.