BeCuriouzLearn something new every day
The padlock lies: why HTTPS doesn't mean "safe"
💡 The padlock means your connection is encrypted, not that the website is trustworthy — always verify the domain name.
You've been told to look for the padlock before typing a password. But the padlock only promises one thing: the connection is encrypted so nobody between you and the server can read or tamper with your traffic. It says nothing about who is on the other end. A scam site can get a valid certificate in minutes — for free — and show the exact same padlock.
The padlock proves the domain you're talking to controls a valid TLS certificate, not that the domain belongs to a company you trust. paypa1-login.com (with a digit '1') can be fully encrypted and still be a phishing trap. In fact, the large majority of phishing pages now use HTTPS precisely because users read the padlock as a seal of approval. Encryption protects the pipe; it does not vet the destination.
The real defense is checking the domain name itself, character by character, especially the part just before the first single slash. Better yet, never reach a login page by clicking a link — type the address yourself or use a saved bookmark, and let a password manager auto-fill only on the exact domain it recognizes. A password manager silently refusing to fill is one of the best lie-detectors you have.