Back to Home
Chapter 1

Why TLS?

Cleartext is loud

Plain HTTP is a postcard. Anyone on the path — your coffee shop's router, an ISP, a bored admin — can read every byte. TLS wraps that postcard in a tamper-evident envelope. Send a login below and watch what a packet sniffer sees with TLS off vs on.

Wire mode
ClientbrowserSniffer😈Serverbank.example
What you send
POST /login HTTP/1.1
Host: bank.example
Content-Type: application/x-www-form-urlencoded

user=admin&pass=hunter2
What the sniffer sees
POST /login HTTP/1.1
Host: bank.example
Content-Type: application/x-www-form-urlencoded

user=admin&pass=hunter2
Anyone on the path can read your password.
Key takeaways
  • Without TLS, every byte on the wire is readable by anyone on the path
  • TLS provides confidentiality, integrity, and server identity
  • It sits between TCP and the application — HTTPS is HTTP over TLS
  • Modern browsers refuse most cleartext traffic, for very good reasons