What Does HTTPS Actually Encrypt?

HTTPS encrypts the letter, not the envelope. Page contents, URL paths, cookies and the passwords you type are all encrypted between you and the site. But the domain you visit (via DNS lookups and the SNI field in the handshake), the site’s IP address, when you connect and how much data moves are still visible to anyone along the way. A VPN wraps the envelope too: onlookers only see that you’re talking to the VPN server.

1. ① Contents encryptedURL paths, cookies, passwords, page content
2. ② Address visibleThe domain (DNS lookup, SNI) and the IP
3. ③ Time and size visibleWhen you connect and how much data moves
4. ④ OnlookersOthers on the Wi-Fi, the ISP, networks en route
5. ⑤ The websiteOnly it can open the envelope and read it

Who can see unencrypted traffic?

Data travelling from your device to a website passes a long line of middlemen:

• Others on the same Wi-Fi: on open café or airport Wi-Fi, common packet-capture tools can show other people’s unencrypted traffic;
• Whoever runs the hotspot or router: all traffic passes through their equipment;
• Your ISP: every byte you send crosses its network;
• Networks along the route: national and international backbones and exchange points.

If the data is unencrypted (sites starting with http://), these parties can not only read it but change it — injecting ads, swapping download links, slipping malicious code into pages. That’s why nearly every site now uses HTTPS.

Encryption with minimal maths

Symmetric encryption: one key for the lock

The same key encrypts and decrypts. It’s fast and good for large amounts of data — algorithms like AES and ChaCha20. The catch: how do two parties agree on a shared key over a network someone might be listening to?

Public-key cryptography: a public lock and a private key

Each side has a key pair: a public key anyone can have and a private key only its owner knows. Anything encrypted with the public key can only be opened with the matching private key; anything “signed” with the private key can be verified by anyone with the public key.

Modern TLS goes a step further with key exchange (such as ECDHE): each side generates temporary values and swaps only the parts that are safe to share, and both arrive at the same shared key — while an eavesdropper who sees the whole exchange still can’t compute it. That shared key becomes the session key used for fast symmetric encryption.

Certificates: proving a site is who it says

Encryption isn’t enough on its own — you also need to know you’re talking to the real site, not an impostor. The site presents a certificate stating its domain and public key, signed by a trusted certificate authority (CA). Browsers and operating systems ship with a list of these authorities and check the signature, the expiry date and that the domain matches. An impostor can’t produce a valid certificate, so the browser shows a warning.

What HTTPS protects — and what it still exposes

This sequence diagram walks through opening an HTTPS site, marking what an onlooker along the way can see at each step:

Step	What happens	What onlookers see
①–② DNS lookup	The browser asks for the domain’s IP address, over plain-text UDP by default	The domain you’re visiting, and the IP that comes back
③ TCP handshake	A connection opens to port 443 at the site’s IP	The site’s IP address
④ ClientHello	The first TLS message includes the domain (SNI) so the server knows which certificate to present	The site’s domain (SNI is plain text)
⑤ ServerHello	The server replies; in TLS 1.3 everything from the certificate onward is already encrypted	That a handshake is happening — not the certificate
⑥ Request	URL path and parameters, cookies, forms, passwords	Nothing but the size and timing
⑦ Response	Page content, images, downloads	Nothing but the size and timing

In summary:

Item	Visible with HTTPS?
Domain you visit	Visible (DNS lookup, SNI)
Site’s IP address	Visible
When, how long, how much data	Visible
Full URL path (e.g. /search?q=…)	Encrypted
Page content, images, video	Encrypted
Cookies, login state, passwords, forms	Encrypted

What a VPN adds on top of HTTPS

A VPN doesn’t replace HTTPS — they stack. Page content is encrypted once by HTTPS, and the whole connection is encrypted again by the VPN. What the VPN hides is precisely the envelope HTTPS leaves exposed:

Item	HTTPS only	HTTPS + VPN
Which domains you visit	Visible along the way	Onlookers only see the VPN server
Site IP addresses	Visible along the way	Onlookers only see the VPN server
DNS lookups	Plain text by default	Done inside the tunnel
Old sites and apps without HTTPS	Fully visible	Encrypted inside the tunnel
Page content	Encrypted	Encrypted

Keep in mind that the VPN server sees the domains you visit once it decrypts the tunnel, so pick a provider that commits to — and technically enforces — not keeping logs. See What is a VPN?.

Related reading

• Previous: VPN vs proxy: what’s the difference?
• Next: System proxy vs TUN mode: three ways to route traffic
• What happens when you open a website? (full TLS handshake diagram)