HTTP vs. HTTPS: What Is the Difference?

While browsing the internet, you’ve probably seen that some websites are marked as “not secure”. And if you took a closer look, you might have noticed that the URLs for those sites begin with http://, while others begin with https://.

What’s the difference between HTTP and HTTPS, and why should you care? Let’s take a look at the difference between both protocols and why HTTPS is a better option for most use cases.

HTTP vs. HTTPS: Starting from scratch 

Before we dive into the nuances of  HTTP vs. HTTPS, let’s first get a general understanding of what these protocols are and how they work.

What is HTTP?

HTTP stands for Hypertext Transfer Protocol and is the standard application layer network protocol used for communication and data transfer between browsers and web servers on the internet. An HTTP request is generated by user interactions on a web browser and sent to a web server, which generates an HTTP response and sends it back to the user.

You might ask is HTTP encrypted? Well, HTTP requests and responses are sent over the internet in plain text format. As a result, anyone monitoring the connection can easily read the encrypted data in those messages. So, is HTTP secure? It’s safer to say no. Thus, HTTP protocol is not ideal for use cases where users must send sensitive data such as passwords or bank details over the internet.

What is HTTPS?

So what does HTTPS mean? And is HTTPS secure? HTTPS stands for Hypertext Transfer Protocol Secure and is an extension of HTTP protocol that uses the Transport Layer Security (or Secure Sockets Layer) protocol to establish an encrypted connection between a server and a web browser. As a result, HTTPS protocol is sometimes referred to as HTTP over TLS or HTTP over SSL protocol. Basically, it is a secure version of HTTP. 

When HTTPS is used, the HTTP requests and responses are encrypted, making it impossible for an attacker or eavesdropper to access any sensitive information contained within them.  

What is the main difference between HTTP and HTTPS?

The main difference between HTTP and HTTPS may be summarized as follows:

• Encryption and authentication
  
  HTTP traffic is not encrypted and susceptible to eavesdropping and man-in-the-middle attacks. HTTPS, on the other hand, uses the TLS (or SSL) security protocol to create a secure connection and only transmits encrypted data over the network. This method of encrypting data involves using a public key and a private key to generate a short-term session key that is then used to encrypt the data transfer between the client and the server.
  
  In public-key encryption, the owner of a private key can encrypt data which anyone can then decrypt with the public key. Also, anyone with the public key can verify that any data received from the private key owner is from an authentic source.

• TLS/SSL certificate
  
  In HTTPS, the public key is stored in a website’s TLS/SSL certificate. These certificates are issued and signed with a private key by a Certificate Authority (CA), any trusted third-party organization that gives SSL certificates. Every web browser has a list of trusted CAs, and most browsers alert users when they receive invalid security certificates.
  
  During a TLS/SSL handshake, public-key encryption is used to authenticate the origin server’s public-key identity and the digital signature on the SSL certificate. Once this process is completed, the client and the server will generate session keys for secure symmetric encryption.

• Data security
  
  All subsequent communication between the server and the client is then encrypted with the session keys. So if anyone intercepts the HTTPS requests and responses, they’ll only see the ciphertext and not any sensitive information. HTTPS also helps protect against malicious activity such as on-path attacks, DNS hijacking, BGP hijacking, and domain spoofing. Therefore, HTTPS is a more secure protocol.