The Lock Icon Doesn’t Mean “Safe”

Picture an armoured van. Bulletproof glass, two guards, sealed strongbox. It collects your letter and delivers it without a soul reading a word on the way.

Genuinely impressive. Also: completely irrelevant to whether the man you’re posting the letter to is a fraudster.

That’s the padlock. It is a magnificent armoured van, and people have somehow decided it’s a character reference.

It used to mean a bit more, which is how we got here

This confusion isn’t stupidity — it’s a hangover.

Around 2014, HTTPS was a minority of web traffic. Certificates cost real money and getting one usually involved a company at least glancing at who you claimed to be. So the padlock genuinely correlated with legitimacy: scammers mostly didn’t bother, so its presence meant something. Browsers doubled down, colouring it green and writing the word Secure next to it in friendly letters.

Every part of that is now false. Certificates are free, automated, and issued in seconds. Somewhere north of 95% of page loads are encrypted, including the malicious ones. Browsers quietly removed the word “Secure” precisely because it was telling people something untrue — but the folk memory stuck around, because we spent a decade training people to look for a padlock.

So let’s be exact about what it actually certifies.

What happens when the padlock appears

1. Step 1 of 5

   Your browser knocks and asks for a private conversation

   It contacts whatever machine answers for the address you typed and says which encryption it can speak, plus the hostname it is looking for. None of this is secret yet — the opening exchange happens in the clear, like agreeing on a language before lowering your voice.

2. Step 2 of 5

   The server hands over an ID card

   The certificate holds a public key and the list of hostnames it covers, signed by a certificate authority your device already trusts. Think of it as a passport — it proves the bearer is who the passport office says. It does not vouch for their character.

3. Step 3 of 5

   Your browser checks three boxes, and only three

   Signed by an authority I trust? Still in date? Does the name on it match the address in my bar? That is the entire inspection. Every one of those can pass for a domain somebody registered eleven minutes ago for the price of a coffee.

4. Step 4 of 5

   A shared secret is agreed, and the padlock appears

   Both sides work out a key that nobody watching the wire can reconstruct, and everything from here is encrypted. The padlock gets drawn at exactly this moment. It is a statement about the tunnel — not about who is waiting at the other end of it.

5. Step 5 of 5

   And here is everything nobody checked

   Whether the operator is honest. Whether this is the company you had in mind. Whether the domain is a near-miss of the one you meant. Whether the page is a login form built this morning to harvest passwords. None of those questions were ever asked, because the handshake has no way to ask them.

The three promises, stated plainly

When your browser shows a padlock, it is claiming exactly this and nothing more:

1. Nobody can read this. Someone on the café Wi-Fi, or at your ISP, can see that you connected to example.com and roughly how much data moved. They cannot see what was in it.
2. Nobody can change this. No ads injected into the page, no swapping your download for something else in transit.
3. You reached whoever controls the domain in the address bar. Not an impostor sitting in the middle.

Now read promise three again and notice how much weight the phrase “the domain in the address bar” is carrying.

The guarantee is: “you really did reach this exact address.”

The guarantee is not: “this address is the one you meant.”

That gap — between the address you reached and the address you intended — is where essentially all phishing lives.

What it says nothing about

Whether the operator is honest. Anyone can get a certificate for a domain they control in about thirty seconds, for free. secure-banking-login.example gets a padlock exactly as fast as your actual bank does. The certificate authority is not vetting anyone’s morals; it is checking whether you can prove you own that domain. That’s it.

Whether the domain is the one you wanted. paypa1.com (that’s a digit one). micros0ft-support.com. yourbank.com.account-verify.io. All perfectly real hostnames someone can register, all able to hold a valid certificate, all showing a padlock, all showing it correctly.

Whether the site is safe. Malware downloads over HTTPS. Phishing forms are served over HTTPS. Scam shops take your card number over HTTPS. Encryption protects the channel, not the cargo. The armoured van will deliver a letter bomb with exactly the same professionalism.

Whether your data survives arrival. TLS ends at the server’s front door. What happens after — whether they hash your password properly, who can query the database, whether it ends up in a debug log — is entirely outside what the padlock can see.

The absence of a padlock, though — that’s clear-cut

The other direction is much simpler:

No padlock means don’t type anything. Not your password, not your card, not your email address.

An unencrypted page can be read and rewritten by anyone on the path. Not just “they can see your password” — the login form you’re looking at may already have been altered before it reached you.

Browsers now shout about this, and most support an HTTPS-only mode. Turn it on and leave it on. It converts a silent downgrade into a visible refusal, which is exactly what you want.

What to check instead

Since the padlock can’t answer “is this the right site”, you have to. Three habits cover nearly all of it.

Read the domain backwards. The real destination is the last chunk before the first single slash. login.microsoft.com.evil.net is evil.net — a building called net, a floor called evil, and a sign in reception that says Microsoft. Your eye reads left first. The truth is on the right.

Look for the character that isn’t there. Lookalikes rely on a substitution you skim straight past: rn where you expect m, a 1 for an l, an extra hyphen, .co where you expect .com. You don’t need to do this on every page. You need to do it once, deliberately, before you type a password.

Don’t arrive at a login page from a link. This is the one that does the heavy lifting. Go to your bank, your email, your work SSO by typing it or using your own bookmark. If a link drops you on a login screen, close the tab and go there yourself. Do that consistently and it stops mattering whether you can spot a lookalike domain at all, because you’ll never be on one with your password ready.

And let your password manager help. It fills based on the exact domain, so on a lookalike site it will simply sit there, silent and unhelpful. That silence is your manager telling you something. Listen to it instead of overriding it and copy-pasting, which — I promise — is what your instinct will suggest.

“What about that green bar with the company name?”

Fair question if you’re old enough to remember it. Extended Validation certificates involved a real check on the organisation, and were meant to be the answer to precisely this problem.

Browsers removed the special display, because study after study found the same three things: users didn’t notice it, didn’t understand it when it was pointed out, and weren’t measurably safer for having it. Meanwhile researchers demonstrated you could obtain EV certificates for convincing-sounding company names anyway. The distinction technically still exists inside the certificate. Nothing in the interface surfaces it, and nothing you do should depend on it.

The one thing to take away

The padlock answers: “is anyone listening to this conversation?”

It does not answer: “should I be having this conversation?”

Those are different questions, and only the second one matters when you’re about to type a password. So get into the habit of reading the domain before you notice the padlock.

The padlock is going to be there either way. That’s rather the point.