The padlock in your browser doesn't mean you are safe

A small grey padlock sits in the address bar of most web browsers. For years, people have been told that this icon is a sign of safety. If the lock is present, the site is trusted. If it is missing, the site is dangerous. This belief turns a technical indicator into a moral judgement on the website owner.

This logic made sense for a long time. In the early days of the web, obtaining a digital certificate to enable that padlock was a slow and expensive process. A company had to pay a third party, known as a Certificate Authority, to verify its identity. The authority would check that the organisation was a legal entity before issuing the certificate. Because it cost money and required paperwork, only legitimate businesses usually bothered with it. The padlock became a proxy for trust. It suggested that a real person or company stood behind the site and had paid for a badge of legitimacy.

A secure tunnel to nowhere#

The technical reality is narrower. The padlock indicates that the connection uses encryption. Encryption scrambles the data sent between a computer and a server so that an eavesdropper cannot read it. This is known as Transport Layer Security, or TLS. It ensures the privacy of the data in transit. It does not, however, verify the intent of the person receiving that data.

A thief can build a very secure tunnel to move stolen goods through. In the same way, a criminal can set up an encrypted connection for a phishing site. Phishing is the act of creating a fake website that looks like a real one to trick a user into entering a password or credit card number. If the criminal uses encryption, the padlock appears. The data travels privately from the victim to the thief. The lock confirms that no one else saw the password during the journey, but it says nothing about the person who now possesses it.

The cost of free trust#

The shift in how certificates are issued changed everything. An organisation called Let’s Encrypt began providing digital certificates for free. They also automated the process. This was a positive move for the general health of the internet because it encouraged every site to use encryption. It stopped hackers from stealing passwords on public Wi-Fi.

The side effect was that the cost of entry for criminals dropped to zero. A phishing site can now obtain a valid certificate in seconds without spending a penny or proving its identity beyond owning a domain name. The padlock ceased to be a sign of an established business and became a standard feature of the web. It is now as common as a font choice.

Browser developers recognised this confusion. Google Chrome and other browsers began to de-emphasise or remove the lock icon. They realised that users were treating it as a safety badge rather than a technical status report. By removing the prominent lock, they hoped to stop people from blindly trusting a site just because the connection was encrypted.

Looking beyond the icon#

Safety is found in the details of the address, not the symbols next to it. A user should look at the domain name itself. A site might look identical to a bank login page and display a padlock, but the address might be slightly misspelled or use an unusual extension. These are the hallmarks of a fraudulent site.

One must also consider the behaviour of the website. Legitimate organisations rarely create a sense of extreme urgency through pop-up windows or demand immediate payment via unusual methods. A secure connection is a basic requirement for modern browsing, but it is not a guarantee of honesty. Trust is earned through verification of the source and cautious observation of the site’s requests.

Check the spelling of the URL in the address bar carefully before entering any sensitive information. If the site asks for a password or payment unexpectedly, visit the official homepage by typing the address manually into the browser rather than clicking a link from an email or message.