How HTTPS works
HTTPS is ordinary web traffic inside an encrypted tunnel. Before any page is sent, the browser and the server agree on a secret key, and the browser checks the server's certificate to be sure it is talking to the right site.
Two jobs: trust and secrecy
The certificate proves the server owns the domain, because a trusted certificate authority signed it. The key exchange lets both sides create the same secret key without ever sending it across the network.
Why it protects you
Anyone watching the connection sees only encrypted data, and cannot change it without detection. That stops passwords and payment details from being read on shared networks.
What it does not do
HTTPS does not make a site honest: a fraudulent site can also have a valid certificate for its own domain. It protects the connection, not the content or the owner's intentions.
Questions
What is the difference between TLS and SSL?
TLS is the modern protocol; SSL is its obsolete predecessor. People still say SSL when they mean TLS.
What is a certificate authority?
An organisation that browsers trust to verify who owns a domain before it signs a certificate for it.
Does HTTPS slow a site down?
Barely. The handshake adds a small delay once per connection, and modern versions reduce it further.
What does the padlock mean?
That the connection is encrypted and the certificate matches the domain. It says nothing about whether the site is safe to trust.