What TLS does and why it exists

TCP agreed on sequence numbers, DNS resolved a name to an IP. Now the browser and server must agree on encryption before anything that matters can travel. That negotiation is the TLS handshake — and it is the difference between a clear-text postcard and a sealed envelope.

What TLS does in one sentence

TLS (Transport Layer Security) wraps every byte of application data in a symmetric-key envelope that nobody on the network can read. The envelope is negotiated via asymmetric cryptography during the handshake; once negotiated, the symmetric key handles all data at line speed.

Plain HTTP sends every word you type in clear text. Your password, your bank balance, the article you are reading — visible to anyone on the same coffee-shop wifi, your ISP, or a corporate proxy. TLS turns that same wire into a locked tunnel.

The sealed-envelope metaphor

Bea wants to mail Sven a message, but she fears the mailman will read it. She puts it in a box, locks it with a seal, and mails it. Only Sven has a matching key. Before mailing, both agree on the seal and the key: Bea proposes locks she knows, Sven picks one and sends his half of the key plus an ID card from Cara the trusted issuer. They combine halves into a shared seal. TLS 1.3 made the meeting shorter by letting Bea send her half in the first message, instead of waiting for Sven to ask.

Three guarantees TLS provides

1. Confidentiality — nobody on the wire can read the data.
2. Integrity — nobody can tamper with the data without detection.
3. Authentication — the server proves it owns the domain (via a certificate issued by a trusted CA).

One scenario end to end

You type https://. The browser has already finished DNS (it knows the IP) and TCP (a connection is open). Now it builds the TLS seal. Once built, every HTTP request and response rides inside it. The browser shows a padlock.

The padlock means: nobody on the network can read what passes between you and this hostname. It does not mean the website is trustworthy — a scam site can have a valid padlock. It does not mean your device is safe. It guarantees only the channel.