The Padlock Icon: What It Really Means
Understand what the browser padlock does and does not guarantee about a website's trustworthiness.
What the Padlock Actually Confirms
The padlock icon in your browser address bar confirms that the connection between your browser and the web server is encrypted using TLS. This prevents eavesdroppers from reading the data in transit.
It also confirms that the server has presented a certificate that your browser could verify: the certificate was signed by a trusted Certificate Authority (CA) and the domain name matches.
What the Padlock Does NOT Confirm
The padlock says nothing about the trustworthiness or legitimacy of the website itself. A criminal can obtain a valid TLS certificate for their phishing site just as easily as a legitimate business can.
The padlock means "your connection to this server is encrypted", not "this website is safe", "this company is legitimate", or "you should trust the content on this page".
All lessons in this course
- The Padlock Icon: What It Really Means
- How Websites Get SSL Certificates
- TLS Certificate Warnings and What to Do
- HTTP Downgrade and Mixed Content Risks