Side by side
HTTPvsHTTPS
What is the difference between HTTP and HTTPS?
Updated 2 min read7 differences
In short
HTTPS is HTTP sent over encrypted TLS: the requests are the same, but HTTPS hides them from eavesdroppers, detects tampering and proves the server's identity.
HTTP
Hypertext Transfer Protocol
HTTP is the protocol that browsers, apps, and servers use to exchange web pages and data through a simple cycle of requests and responses.
Read the page on HTTPHTTPS
Hypertext Transfer Protocol Secure
HTTPS is the secure version of HTTP that encrypts traffic between a browser and a website with TLS, protecting data from eavesdropping and tampering.
Read the page on HTTPSHTTP and HTTPS compared
| Aspect | HTTP | HTTPS |
|---|---|---|
| Encryption | None; data travels as readable text | Encrypted with TLS |
| Default port | 80 | 443 |
| URL scheme | http:// | https:// |
| Certificate | Not needed | Requires a TLS certificate for the domain |
| Integrity | Data can be altered in transit without notice | Tampering is detected and the connection fails |
| Browser treatment | Labeled not secure; many modern APIs are blocked | Padlock shown; full access to modern web APIs |
| Protocol versions | HTTP/1.1 only in browsers | HTTP/1.1, HTTP/2 and HTTP/3 |
The difference, explained
HTTP (Hypertext Transfer Protocol) is the protocol browsers and servers use to exchange web pages and API data. HTTPS is the same protocol carried inside TLS (Transport Layer Security), which encrypts the URL path, headers, cookies and body before they travel over the network.
The difference exists because plain HTTP can be read and changed by anyone between you and the server, such as a public Wi-Fi operator or a compromised router. TLS adds three guarantees: confidentiality through encryption, integrity so any change is detected, and authentication through a certificate that proves you are talking to the real domain.
HTTPS does not replace HTTP; it carries it. Methods, status codes and headers work exactly the same, and servers typically redirect http:// to https:// and send an HSTS header so browsers never use the insecure version again. Browsers only speak HTTP/2 over TLS, and HTTP/3 always has encryption built in.
A common misconception is that HTTPS is slow or only needed on login and payment pages. With TLS 1.3 the extra cost is small, browsers label plain HTTP pages as not secure, and many modern features, like service workers and geolocation, require HTTPS. Another is that the padlock means a site is trustworthy: it only means the connection is private, not that the site is honest.
Which one should you use?
Choose HTTP when…
- Traffic stays on your own machine during local development.
- Services talk inside a private network after TLS ends at a trusted proxy.
- A server on port 80 only redirects visitors to the HTTPS version.
Choose HTTPS when…
- Your site or API is reachable from the public internet.
- Users log in, submit forms or send any personal data.
- You need modern browser features like service workers or HTTP/2.
- You want users and search engines to trust your site.
Readers ask
Is HTTPS slower than HTTP?
Only slightly, on the first connection. TLS 1.3 needs just one round trip to set up, and HTTPS unlocks HTTP/2 and HTTP/3 in browsers, so in practice HTTPS sites are often faster.
Does HTTPS hide which websites I visit?
Partly. It hides the page path, content and cookies, but the domain name is often still visible through DNS lookups and the TLS handshake unless encrypted DNS and Encrypted Client Hello are used.
Do HTTPS certificates cost money?
Not necessarily. Free, automated certificate authorities issue trusted certificates at no cost, and many hosting platforms enable HTTPS automatically.