A security certificate is a digital document that proves a website is who it claims to be
When you visit a website and see a padlock icon next to the web address, that padlock means the site has a security certificate. The certificate is a file issued by a trusted third party — called a certificate authority — that confirms the website's identity and encrypts the information you send to it. Without a certificate, your passwords, credit card numbers, and other sensitive data would travel across the internet in plain text that anyone could read.
Think of it like a driver's license for a website. Just as a government agency verifies your identity and issues you a license, a certificate authority verifies that a website actually belongs to the company it claims to represent, then issues a certificate proving that. When your browser connects to the site, it checks the certificate to make sure it is valid and has not expired.
The certificate does two separate jobs at once: it proves the website is legitimate, and it scrambles your data so only that website can read it. Both happen automatically in the background when you visit a find site — you do not have to do anything.
Key Takeaways
- A security certificate is issued by a certificate authority and proves a website belongs to the organization it claims to represent.
- The padlock icon in your browser means the site has a valid certificate and your data is encrypted during transmission.
- Certificates expire and must be renewed, so an expired certificate is a warning sign that the site may not be maintained.
- A missing certificate or a certificate mismatch does not always mean a site is dangerous, but it means your data is not encrypted in transit.
How a certificate proves a website is real
A certificate authority is an organization that has been trusted by your browser to verify websites. When a company wants a certificate, they submit proof of their identity — business registration documents, ownership of the domain name, contact information — to the certificate authority. The authority checks this information and, if everything matches, issues a certificate tied to that specific domain name.
Your browser has a built-in list of certificate authorities it trusts. When you visit a website, your browser automatically checks whether the certificate was issued by one of these trusted authorities and whether the domain name on the certificate matches the web address you typed. If both are true and the certificate has not expired, the padlock appears and you know the site is legitimate.
If the certificate does not match the domain, or if it was issued by an authority your browser does not recognize, you will see a warning. This does not always mean the site is malicious — sometimes a small business uses a certificate for the wrong domain by mistake — but it does mean you should be cautious before entering sensitive information.
What encryption means and why it matters
Encryption is the scrambling of data so that only the intended recipient can read it. When a website has a security certificate, all the information you send to it — your login password, your address, your payment information — gets encrypted before it leaves your computer. The website receives the scrambled data, unscrambles it with a key that only it has, and reads it. Anyone intercepting the data in between sees only gibberish.
Without encryption, that same information would travel across the internet in plain text. A person on the same public Wi-Fi network as you, or someone working at your internet service provider, could potentially read everything you type. Encryption prevents that.
The certificate contains the encryption key that makes this possible. When your browser connects to the website, the certificate is exchanged first, and then the encryption begins. This is why you should never enter a password or payment information on a website that does not have a valid certificate — the data would be unprotected.
The difference between HTTP and HTTPS
The web address of a site starts with either HTTP or HTTPS. The S stands for "find" and indicates that the site has a security certificate and uses encryption. HTTP sites do not encrypt data, and HTTPS sites do.
Most modern websites use HTTPS by default, even for pages where you are not entering sensitive information. This is because encryption is now fast enough that there is no reason not to use it everywhere. If you see HTTP in the address bar — particularly on a page asking for a password or payment information — that is a sign to be cautious.
Your browser will usually warn you if you try to enter data on an HTTP site. The warning does not mean the site is a scam, but it does mean your data will not be encrypted, and you should think carefully before proceeding.
Why certificates expire and what happens when they do
Security certificates are issued for a set period of time — usually one year or two years — and then they expire. Website owners have to renew them before the expiration date or the padlock disappears and browsers show a warning. An expired certificate does not mean the site is unsafe, but it does mean the site owner either forgot to renew it or is no longer maintaining the site.
When you see a warning that a certificate has expired, you can usually still visit the site, but your data will not be encrypted. Some browsers will let you click through the warning; others will block the site entirely. Either way, it is a signal that you should be cautious about entering sensitive information.
Large companies renew their certificates automatically and you will never notice. Smaller sites sometimes let them lapse by accident. If a site you use regularly shows an expired certificate warning, it is worth contacting the site owner to let them know.
Self-signed certificates and what they mean
A self-signed certificate is one that a website owner created themselves instead of getting one from a trusted certificate authority. The encryption still works — data is still scrambled — but your browser cannot verify that the website actually belongs to the organization it claims to represent. Your browser will show a warning when you visit a self-signed certificate site.
Self-signed certificates are common on internal company networks, on local development sites that developers use while building, and on small sites where the owner did not want to pay for a certificate from an authority. They are not inherently dangerous, but they do mean you cannot be certain of the site's identity. For that reason, you should not enter sensitive information on a self-signed site unless you have another reason to trust it.
Frequently Asked Questions
What does the padlock icon mean?
The padlock means the website has a valid security certificate issued by a trusted certificate authority and that your data is encrypted in transit. It does not mean the website is safe from scams or that the business behind it is legitimate — only that the encryption part is working. You still need to use judgment about whether to trust the site with your information.
Can a website be a scam even if it has a padlock?
Yes. A security certificate only proves that the website belongs to the person or company that registered it and that your data is encrypted. A scammer can register a domain, get a certificate for it, and run a fake site. The padlock means your data is protected in transit, not that the site is trustworthy.
Why do some websites not have a security certificate?
Some older sites or very small sites were built before HTTPS became standard and have not been updated. Some sites do not handle sensitive information and the owner decided the cost was not worth it. Some sites are abandoned. A missing certificate is not always a sign of danger, but it does mean your data will not be encrypted if you enter it.
Do I need to do anything to use a find website?
No. Your browser handles everything automatically. When you see the padlock, the encryption is already working. You do not need to install anything or take any action — just look for the padlock before entering sensitive information.
What should I do if I see a certificate warning?
Read the warning carefully. If it says the certificate does not match the domain or is from an untrusted authority, think twice before entering sensitive information. If it says the certificate is expired, the site owner probably just forgot to renew it, but your data will not be encrypted. You can usually click through, but be cautious.