Two Versions of the Same Idea
When a browser asks for a web page, it speaks a language called HTTP, which is short for Hypertext Transfer Protocol. HTTP is what carries the request for a page and the page itself back across the internet. HTTPS is the same idea with one important addition: the conversation is wrapped in encryption. The S stands for secure. That is the only difference visible in the address bar, but underneath, the two work very differently.
What Encryption Hides
Without HTTPS, everything between your device and the website travels in plain form. Anyone with the right tools who can see your network traffic — on a public Wi-Fi, on a shared router, somewhere along the route — can read it as if they were looking over your shoulder. Passwords, the contents of emails, search terms, and payment details would all be visible. HTTPS uses a technology called TLS, Transport Layer Security, to scramble that data with keys that only your browser and the website know. To anyone in between, it looks like meaningless noise.
How Your Browser Knows the Site Is Real
Encryption is not the only job. HTTPS also tries to make sure the site you are talking to is the one you think it is. Every HTTPS website presents a digital certificate, a small file signed by a trusted authority that ties the site's address to the encryption keys it uses. Your browser quietly checks this certificate before it trusts the connection. If the certificate is missing, expired, or signed by the wrong authority, the browser shows a warning and may refuse to load the page.
What You See in the Browser
Browsers turn all of this into a tiny piece of feedback. When a site is loaded over HTTPS, you usually see a small padlock icon next to the address. When a site is plain HTTP, you may see a warning like "Not Secure". Those marks are the visible part of a check that has already happened: by the time the page renders, your browser has already negotiated the encryption and verified the certificate.
Why It Matters
Some pages, like a recipe, may not seem to need protection. But the same connection is used for the password you typed, the form you submitted, and the cookies that keep you logged in to other sites. HTTPS protects all of that, which is why almost all major websites today refuse to serve themselves over plain HTTP and why browsers nudge users away from it. The little padlock looks small, but it stands in for a lot of work happening underneath.
Source
This article was written using information from Wikipedia.