Does HTTPS mean a website is safe?

No — and this is one of the most persistent misunderstandings in basic internet safety advice. HTTPS and the padlock icon confirm exactly one thing: your connection to whatever domain you're currently on is encrypted. They say nothing about who registered that domain, what they intend to do with anything you type into it, or whether the page is a faithful copy of a company you trust or a convincing forgery of one.

What HTTPS actually guarantees

It helps to be precise about this, because the gap between what HTTPS proves and what people assume it proves is exactly where the misunderstanding lives.

Your connection is encrypted

Data traveling between your browser and the server is scrambled using TLS, so anyone intercepting it — your ISP, someone on the same Wi-Fi network, anyone positioned between you and the destination — sees unreadable noise instead of your actual traffic.

You're talking to the exact domain shown in the address bar

The certificate cryptographically proves the site responding to your request really does control the domain named in its certificate. That's a real, meaningful guarantee — it's just a narrower one than most people assume. It confirms you're on paypal-security-update.info if that's what you typed or clicked. It says nothing about whether that domain has anything to do with the real PayPal.

What HTTPS does not guarantee

None of the following are things a padlock checks, verifies, or even attempts to check:

• Whether the business or person running the site is who they claim to be
• Whether the site's content is honest, accurate, or non-malicious
• Whether the domain was registered five years ago or five minutes ago
• Whether the page you're looking at is a phishing clone of a real company's site

Why a phishing site can get a padlock in minutes

Free, automated certificate authorities — Let's Encrypt is the largest — will issue a valid DV certificate to any domain the requester can prove they control, which for a newly registered domain takes minutes, not days. No human reviews the request, and nothing checks what the site plans to do with it. This is genuinely good for the web overall — it's a major reason HTTPS adoption climbed from a minority of sites to the overwhelming majority in under a decade — but it also means "this site has a valid certificate" stopped correlating with "this site went through any kind of vetting" a long time ago.

Browsers used to tell you more — and deliberately stopped

This part of the story rarely makes it into basic security advice, but it's the clearest evidence that the industry itself has concluded the padlock oversold its own meaning.

The green address bar experiment

Starting in 2007, a more rigorous certificate type called Extended Validation (EV) let browsers display the verified company's legal name directly in a green address bar — Safari, Chrome, and Firefox all supported it, and the idea was straightforward: real identity verification, shown prominently, should help people spot fakes.

Google's own security team explained the reasoning plainly in their announcement: "the EV UI does not protect users as intended." Independent research backed this up — a study by Thompson et al. found that even with the green bar present, 85% of test users still failed to identify a phishing site by examining the address bar. The indicator that was supposed to be the strongest anti-phishing signal in the browser simply didn't move the needle on the behavior it was meant to change.

The padlock itself is being phased out next

The same pattern repeated with the padlock icon itself. Chrome's own 2021 research, surveying 1,880 users, found that 89% misunderstood what the padlock actually indicated, and only 11% could correctly describe it. Starting with Chrome 117 in September 2023 (rolling out further through Chrome 120 on some platforms), Google replaced the padlock with a neutral "tune" icon — deliberately less reassuring-looking, specifically so it stops implying "trustworthy" when the only thing it can honestly promise is "encrypted." Safari has also moved away from the traditional lock icon; Microsoft Edge, built on the same underlying engine as Chrome, was still showing the padlock as of early 2025, though it tends to follow Chrome's UI decisions eventually.

The only thing your browser reliably warns you about

Given everything above, it's worth being precise about what browsers are actually good at flagging — because there is one thing they catch reliably, and it isn't phishing.

Modern browsers actively flag plain HTTP pages that contain a password or payment field, marking the address bar "Not Secure" and, as shown above, logging an explicit warning in the developer console. This is a genuinely useful, reliable signal — but notice what it's detecting: the absence of encryption, not the presence of bad intent. A browser has no mechanism to warn you that an HTTPS page is a phishing clone, because from a pure protocol standpoint, a perfectly encrypted connection to a scam site and a perfectly encrypted connection to your real bank look identical. The warning system was built to catch a specific, checkable condition — no encryption — not a subjective one like "who runs this."

What to actually check instead

None of this means HTTPS doesn't matter — always prefer it over plain HTTP, and treat a password field on an HTTP page as a genuine red flag. It means the padlock was never designed to answer the question most people use it to answer. What actually helps:

• Read the domain itself, not just a brand name that happens to appear somewhere in the URL — our phishing attack guide covers the specific patterns (subdomain tricks, typosquats, look-alike characters) worth knowing.
• Check a suspicious link before visiting it with our phishing link detector, which looks at domain age, redirect chains, and blocklist status — none of which the padlock touches.
• Let a password manager make the call for you. A manager that only autofills on the exact domain it was saved for will simply stay silent on a convincing look-alike domain, regardless of whether that domain has a padlock.
• Verify through a channel the site itself didn't provide — open your banking app directly, or call the number printed on your card, rather than trusting a link or number the page gave you.