What TLS does and why it exists

What TLS does in one sentence

TLS (Transport Layer Security) wraps every byte of application data in a symmetric-key envelope that nobody on the network can read. The envelope is negotiated via asymmetric cryptography during the handshake; once negotiated, the symmetric key handles all data at line speed.

Plain HTTP sends every word you type in clear text. Your password, your bank balance, the article you are reading — visible to anyone on the same coffee-shop wifi, your ISP, or a corporate proxy. TLS turns that same wire into a locked tunnel.

The sealed-envelope metaphor

Bea wants to mail Sven a message, but she fears the mailman will read it. She puts it in a box, locks it with a seal, and mails it. Only Sven has a matching key. Before mailing, both agree on the seal and the key: Bea proposes locks she knows, Sven picks one and sends his half of the key plus an ID card from Cara the trusted issuer. They combine halves into a shared seal. TLS 1.3 made the meeting shorter by letting Bea send her half in the first message, instead of waiting for Sven to ask.

Three guarantees TLS provides

Why does this matter in practice? Because breaking any one of these three opens a different class of attack — eavesdropping, tampering, or impersonation. Understanding which guarantee covers which attack lets you reason clearly about what TLS can and cannot fix.

1. Confidentiality — nobody on the wire can read the data.
2. Integrity — nobody can tamper with the data without detection.
3. Authentication — the server proves it owns the domain (via a certificate issued by a trusted CA).

Together these three mean: your data reaches the right server unchanged and unreadable to anyone in between. Remove authentication and you might encrypt traffic to an impostor; remove integrity and a middlebox could flip bits undetected.

One scenario end to end

You type https://. The browser has already finished DNS (it knows the IP) and TCP (a connection is open). Now it builds the TLS seal. Once built, every HTTP request and response rides inside it. The browser shows a padlock.

The padlock means: nobody on the network can read what passes between you and this hostname. It does not mean the website is trustworthy — a scam site can have a valid padlock. It does not mean your device is safe. It guarantees only the channel.