TLS and HTTPS are related, but they are not the same thing. TLS is the encryption protocol that protects data in transit. HTTPS is HTTP running over TLS. When a browser shows a lock icon, it usually means the website is using HTTPS, and HTTPS relies on TLS underneath.
TLS vs HTTPS
- TLS is the security protocol.
- HTTPS is the secure version of HTTP that uses TLS.
- SSL is the old name people still use, but modern sites use TLS.
- A TLS handshake negotiates encryption before protected data is exchanged.
- HTTPS protects the connection, not the honesty of the website.
TLS vs HTTPS comparison
| Term | Meaning | Example |
| HTTP | Web protocol without built-in encryption | http://example.com |
| TLS | Encryption and authentication protocol | Protects browser-to-server traffic |
| HTTPS | HTTP over TLS | https://example.com |
| SSL | Older predecessor name | Still used casually in “SSL certificate” |
| TLS handshake | Negotiation before encrypted traffic | Certificate check and session key setup |
What happens in a TLS handshake?
Before the browser sends protected data, it and the server agree on security settings. The browser checks the server certificate, negotiates encryption, and establishes keys for the session. After that, HTTP data can travel inside the encrypted TLS tunnel as HTTPS.
What HTTPS protects and what it does not
- It protects data from casual interception on the network.
- It helps confirm you are connected to the domain shown in the address bar.
- It does not prove the business behind the site is trustworthy.
- It does not stop phishing on lookalike domains.
- It does not clean malware from downloaded files.
Why people still say SSL
SSL is outdated, but the phrase “SSL certificate” is still common. In practice, modern certificates are used with TLS. So when people compare SSL, TLS, and HTTPS, they often mix historical naming with current technology.
FAQ
Is TLS the same as HTTPS?
No. HTTPS is HTTP protected by TLS. TLS is the underlying security protocol.
Is SSL still used?
Modern secure websites use TLS. “SSL” often remains as a casual or marketing term.
Does HTTPS mean a site is safe?
No. HTTPS protects the connection, but phishing and scam sites can also use HTTPS.
What is a TLS handshake?
It is the setup process where browser and server verify the certificate and agree on encryption before sending protected data.
