How HTTPS Works: Asymmetric and Symmetric Cryptography

Plain HTTP sends data as unencrypted text. Anyone on the path can capture or inject scripts into your session. HTTPS (HTTP Secure) wraps HTTP requests and responses inside an encrypted layer called Transport Layer Security (TLS).

When establishing a TLS connection, the client and server use asymmetric encryption (public-key cryptography). The server sends its TLS certificate containing its public key. The client verifies the certificate validity and uses the public key to securely negotiate a temporary session key.

Asymmetric encryption is computationally expensive. Once the client and server agree on a shared session key, they switch to symmetric encryption (where the same key encrypts and decrypts all traffic) for the remainder of the session, providing fast, secure transfer.