IT basics
What the padlock in your browser does and does not mean
For years, people were told to look for the padlock. Now most scam sites have one.
1 min readExplainer
The short version
The padlock means your connection to the site is encrypted. It does not tell you whether the site is honest.
What it means
The padlock, and an address starting with https://, mean that the connection between your browser and the website is encrypted. Nobody in between, such as someone on the same public Wi-Fi, can read what you send or change what you receive.
It also means a certificate company has confirmed that whoever runs the site controls that web address.
What it does not mean
It does not mean the site is safe, legitimate or who it claims to be. Certificates are free and automatic to get, so scammers use them too. A fake bank sign-in page at secure-login-bank-help.com can have a perfectly valid padlock, because its owner really does control that address.
Browsers have started to hide or simplify the padlock for this reason. It is now simply expected.
What to check instead
- The web address: is it really the company’s domain?
- How you got there: did you type it or use a bookmark, or follow a link from a message?
- What the site is asking for: passwords, payment or personal details deserve extra care.
When to worry
If a site you use normally shows a warning about its certificate or connection, stop. That is the case the padlock exists for. Do not click through; tell your IT provider.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.