An old rule that needs updating
For years, people were told to look for a padlock before entering a password or card number. That advice was a sensible shortcut when secure connections were uncommon. Today most websites use them, including sites built to deceive. The padlock is still worth noticing, but it answers a narrower question than people assume.
What the padlock means
The padlock, or a similar icon depending on the browser, shows that your browser has made an encrypted connection to the site using HTTPS. In general terms, this has two effects.
Privacy in transit. The information moving between your browser and the site is scrambled, so someone watching the network, such as another user on the same Wi-Fi, generally cannot read it. This matters most on shared networks, and it reduces some of the open hotspot risks people worry about.
The right server for that address. The site has proven, through a certificate issued by a certificate authority, that it controls the domain name shown in the address bar. The connection is secured to that domain. It does not say who the owner is beyond that, or anything about their intentions.
Some browsers now show a different icon or no lock at all for secure pages, and display a warning for unencrypted ones. Look for the warning wording rather than a particular symbol, since designs change.
What the padlock does not mean
It does not mean:
- The site is honest. Anyone can register a domain and obtain a certificate, often for free. A fake shop, a fraudulent bank page and a scam page can all show the padlock.
- The site is the organization you expect. The padlock confirms the connection is to the domain in the address bar. If that domain is a lookalike, the connection is securely encrypted to the wrong place. This is why reading the address matters, as covered in our guide to lookalike web addresses.
- The site is free from malware. A secure connection can deliver harmful files as easily as safe ones.
- Your data is safe after it arrives. Once your details reach the site, how it stores them is a separate matter. Encryption in transit does not prevent a company from being breached or from misusing information.
- The page content is accurate. Misleading claims, scams and false information can be served over HTTPS.
Why scammers use it
Because browsers now warn visitors about unencrypted pages, fraudulent sites obtain certificates to avoid those warnings. The padlock then lends them a false sense of reassurance. Attackers sometimes even mention it in messages, saying a page is “secure” to put you at ease. Treat that wording as a sales line, not evidence. Many phishing messages direct people to exactly this sort of page.
What to check instead
Use the padlock as a minimum requirement, not a verdict. A more dependable set of checks:
- Read the domain. Is it the exact address of the organization you intended to reach? Be especially alert to extra words, unusual endings and subdomain tricks.
- Think about how you arrived. Did you type the address, use a bookmark or follow a link in an unexpected message? Reaching a site through a message you did not expect deserves more caution.
- Look at the site itself. For shops, check for clear contact details, return policies and a real business address, and search for independent feedback. Our guide on how to check a shopping website before you buy goes through this in more detail, and store legitimacy checks help you avoid fake stores.
- Consider what is being asked. A site demanding urgent payment, unusual payment methods or sensitive details that do not fit its purpose is a warning regardless of the lock.
- Use a password manager. If it does not offer your saved login on a page that looks right, stop and check the address.
- Be careful with payment methods. Cards and payment wallets can offer more protection than bank transfers, though protections vary by country and provider.
Warnings about certificates
Sometimes a browser shows a full-page warning that a connection is not private or that a certificate is invalid. This can happen for innocent reasons, such as a wrong date on your device or a misconfigured site, but it can also signal a problem. For logins, payments or anything sensitive, do not click through the warning. Check your device’s date and time, try a different network and come back later, or contact the organization through a known channel.
Public networks
On shared or public networks, HTTPS provides valuable protection for the content of what you send. It is a reason to avoid entering details on pages that show an unencrypted warning. It does not stop someone from setting up a fake hotspot or sending you to a lookalike page, so the other habits still apply.
Keeping the right mental model
Think of the padlock as a sealed envelope. It tells you that nobody can casually read the message on the way, and that it is going to the address written on the front. It does not tell you whether the person at that address is trustworthy.
This article gives general information. Browser icons and wording change over time, so check how your own browser presents secure and insecure pages.