HTTP sends web data without providing built-in encryption, while HTTPS uses TLS to encrypt and protect data exchanged between a client and a web server. HTTPS therefore provides greater confidentiality, authentication, and integrity.
How HTTP and HTTPS Work
Hypertext Transfer Protocol (HTTP) is an application-layer protocol used to request and transfer resources such as web pages. A browser sends an HTTP request to a server, which returns an HTTP response.
Hypertext Transfer Protocol Secure (HTTPS) uses HTTP over Transport Layer Security (TLS). During the TLS handshake, the server presents a digital certificate, normally issued by a trusted certificate authority, to authenticate its identity. Cryptographic methods then establish session keys for efficient encrypted communication.
HTTPS provides three main security properties:
- Confidentiality: encryption prevents intercepted data from being read easily.
- Authentication: the certificate helps verify that the client is communicating with the intended server.
- Data integrity: TLS can detect whether transmitted data has been altered.
| Feature | HTTP | HTTPS |
|---|---|---|
| Encryption | No built-in transport encryption | Data is encrypted using TLS |
| Server authentication | Not provided | Uses a digital certificate |
| Data integrity | Not protected by HTTP itself | Alteration can be detected |
| Default port | Port 80 | Port 443 |
| URL scheme | http:// | https:// |
For example, login credentials sent through HTTP could be intercepted and read by an attacker monitoring the network. With HTTPS, the transmitted data is encrypted in transit, making captured information unintelligible without the required cryptographic keys.
A common misconception is that HTTPS proves a website is trustworthy. It only secures the connection and authenticates control of the certified domain; a malicious website can still use HTTPS. It also does not necessarily hide metadata such as the destination IP address.
IB Exam Technique
For an A2.1 network fundamentals question, do not state only that HTTPS is “safer.” Explain that HTTPS combines HTTP with TLS and identify encryption, authentication, and data integrity. If asked to compare, give paired differences rather than describing only one protocol.
