The Padlock Icon: What It Really Means

The padlock icon in your browser address bar confirms that the connection between your browser and the web server is encrypted using TLS. This prevents eavesdroppers from reading the data in transit.

It also confirms that the server has presented a certificate that your browser could verify: the certificate was signed by a trusted Certificate Authority (CA) and the domain name matches.

The padlock says nothing about the trustworthiness or legitimacy of the website itself. A criminal can obtain a valid TLS certificate for their phishing site just as easily as a legitimate business can.

The padlock means "your connection to this server is encrypted", not "this website is safe", "this company is legitimate", or "you should trust the content on this page".

Phishing sites routinely use HTTPS. Let's Encrypt issues free certificates automatically to anyone who controls a domain, including criminals who have registered lookalike domains like "paypa1.com" or "arnazon.com".

Google's Transparency Report shows that over 90% of phishing pages now use HTTPS. The presence of a padlock is not a reliable indicator of safety; the domain name itself must be verified.

Domain Validation (DV) certificates, the most common type, only verify that the applicant controls the domain. The CA checks this via DNS records, a file placed on the web server, or an email to the domain's administrative contact.

DV certificates can be issued in minutes via ACME protocols (used by Let's Encrypt). They confirm domain control but provide no information about the organization behind the domain.

Organization Validation (OV) certificates require the CA to verify the organization's legal existence. The CA checks business registration records, confirms the organization's address, and verifies that the person requesting the certificate is authorized to act for the organization.

OV certificates include the organization's name in the certificate data. They take days to issue and cost more than DV certificates, but provide stronger assurance of organizational identity.

Extended Validation (EV) certificates require the most rigorous verification: legal existence, operational existence, physical address, and direct confirmation with authorized personnel. The process takes one to several weeks.

EV certificates historically displayed the organization's name in the browser address bar in green. However, Chrome removed the EV indicator in 2019 citing usability research showing users did not understand or notice it.

Certificate Transparency (CT) is a mechanism where every issued certificate must be logged in public, auditable logs. Browsers check that certificates appear in CT logs before trusting them.

CT logs allow domain owners to monitor for unauthorized certificates issued for their domains. If a CA misissues a certificate, it will appear in the log within hours, enabling rapid detection and revocation.

In any modern browser, you can click the padlock to view connection details. Chrome shows "Connection is secure", the certificate validity period, and the issuing CA. Clicking "Certificate is valid" shows the full certificate chain.

The certificate details include: the Common Name and Subject Alternative Names (covered domains), the issuing CA, the validity period (not before / not after), and the signature algorithm.

Since 2017, Chrome marks all HTTP pages as "Not Secure" in the address bar. Firefox and Edge followed. This warning appears because HTTP transmits all data in plaintext, visible to anyone on the network.

The "Not Secure" label is particularly prominent when a user starts typing into a form on an HTTP page, warning that credentials or personal data will be sent unencrypted.

HTTPS is now the baseline expectation for any website, not a premium security feature. Its presence means the channel is encrypted, which is necessary but not sufficient for overall site security.

Content security, authentication security, authorization controls, injection vulnerability prevention, and dozens of other security properties are entirely separate from whether the connection uses HTTPS.

Beyond the padlock, verifying site legitimacy requires checking the exact domain name for typosquatting, looking for OV or EV certificate details if available, verifying the site via search engine results rather than clicking links in emails, and checking domain registration age and ownership via WHOIS lookup.

Security-conscious users bookmark important sites like their bank rather than typing the URL each time, reducing the risk of mistyping into a typosquatted domain that may have a valid HTTPS certificate.

Test your understanding of what the browser padlock icon means.

The padlock icon confirms an encrypted TLS connection and certificate validation by a trusted CA. It does not confirm the trustworthiness of the website or organization.

Phishing sites can and do use HTTPS. DV certificates require only domain control verification and are issued in minutes. Certificate Transparency logs allow monitoring for unauthorized certificates. HTTPS is necessary but not sufficient for overall security.