Encryption in Transit
Definition
Encryption in transit covers the journey rather than the destination. When a browser loads a page over HTTPS, it first negotiates a TLS session with the server, agrees a cipher and a set of session keys, and everything after that — the request line, the headers, the cookies, the file itself — travels encrypted. TLS 1.2 and TLS 1.3 are the versions in current use; 1.3 removed the older cipher suites and cut the handshake to a single round trip, which makes it both safer and faster. Two guarantees come together in one mechanism: confidentiality, so an observer on the café wifi or at an intermediate network cannot read the traffic, and authentication, so the certificate proves the server really is the host named in the address. What stays visible to an observer is the destination address and, in most deployments, the hostname requested during the handshake — they can see that you visited a site, not what you fetched from it.
Why It Matters
Without it, everything is readable and changeable by whoever carries the packets. Plain HTTP on a shared network exposes session cookies and form fields, and worse, allows content to be modified on the way past — injected adverts and rewritten download links are a documented practice of some networks, not a theoretical risk. Browsers have made the choice for everyone: modern versions mark plain HTTP pages as not secure, block forms on them, and refuse mixed content, so an image loaded over HTTP inside an HTTPS page simply does not appear. There is also a search consequence, since HTTPS has been a ranking signal for years. Pairing matters here: encryption in transit protects the wire and does nothing for the stored copy, while encryption at rest protects the stored copy and nothing on the wire — you want both, and neither substitutes for the other.
How It Works
The handshake begins with the client offering the versions and cipher suites it supports and naming the host it wants through the Server Name Indication extension. The server replies with its certificate chain, the client checks that chain against the trust store in the operating system or browser and confirms the name matches, and the two derive session keys through an ephemeral key exchange — ephemeral meaning that recording today's traffic does not help an attacker who steals the server key next year. Certificates are usually issued free by an automated authority on a ninety-day cycle and renewed by the host without anyone being told. Adding the Strict-Transport-Security response header tells the browser to use HTTPS for that host for a stated period, removing the first insecure request that a typed address would otherwise make. Anything a page pulls in has to follow the same rule, because one script tag with an http address is enough to trigger a mixed content block.
Real-World Example
A translator sends a client a 9 MB signed contract scan published at contract-final.99helpers.site while sitting in an airport lounge. The address is fetched over HTTPS, so the airport network sees a connection to the host and a quantity of bytes, and not the document, the filename or the password typed into the page in front of it. The certificate is issued and renewed automatically by 99helpers, so there is nothing to configure and nothing to expire at an awkward moment. Had the same file been served over plain HTTP, the password field alone would have been a bad idea in that room.
Common Mistakes
- ✕Assuming a padlock means the site is trustworthy — it means the connection is encrypted to that host, and a phishing page can have one too
- ✕Hard-coding an http address for one script or image and wondering why part of the page is missing — the browser blocked it as mixed content
- ✕Treating transport encryption as a substitute for encrypted storage — the moment the file lands, TLS has stopped being involved
Related Terms
Encryption at Rest
Storing files in encrypted form, so the bytes on disk are meaningless without the key. It protects data that is sitting still — on a drive, in a backup, on hardware being retired.
TLS
Transport Layer Security, the protocol that encrypts traffic between a browser and a server and verifies which server it is talking to. SSL was its predecessor and is long dead, but the old name stuck to the paperwork.
HTTPS
HTTP carried inside an encrypted TLS connection, shown in the browser as an https:// address. It is the same web protocol as before, with the traffic protected and the server's identity checked first.
SSL Certificate
A small signed file that proves a server is genuinely the one answering for a given hostname, so a browser will open an encrypted connection to it. Everyone calls it an SSL certificate, though the protocol it is used with has been called TLS for years.
Mixed Content
A page loaded over an encrypted connection that pulls in at least one image, script, stylesheet or font over plain HTTP. The browser responds by removing the padlock, and for anything that can run code, by refusing to load it at all.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →