The padlock in your address bar is backed by something most people never think about: a digital certificate. It is the credential that proves a website is who it claims to be and lets your connection be encrypted. Understanding it helps you read those security warnings correctly. Our GetMyPassword team explains what a digital certificate is and what it does — and does not — guarantee.
What a digital certificate is
A digital certificate (the SSL/TLS certificate behind HTTPS) is an electronic document that proves a website’s identity and holds the keys used to encrypt your connection. It is issued by a trusted Certificate Authority that checks the site owner before signing it. When your browser sees a valid certificate, it shows the padlock and secures the traffic between you and the site.
How your browser uses it
Every time you load a secure page, your browser quietly checks the certificate: is it issued by a trusted authority, is it still valid, and does it match the domain you are visiting? If all three pass, you get the padlock and an encrypted connection. If any fail, you see a warning — and that warning is worth heeding, not clicking past.
What it proves — and what it does not
- It proves your connection is encrypted and you reached the real owner of that domain.
- It does not prove the site is honest — scammers can get certificates too.
- The padlock means “private,” not “trustworthy.” Always check the domain itself.
- Certificate warnings can signal an expired cert, a misconfiguration or an attack.
The padlock guarantees no one is eavesdropping on your connection — not that the site at the other end is honest. A phishing page can have a perfect padlock, so always read the domain, not just the lock.
What it means for your security
A valid certificate means your password is encrypted as it travels to a site, which is essential — never log in over a connection your browser warns about. But because a padlock alone does not prove honesty, the rest is on you: check the domain is the real one, and protect your accounts with a unique password from our password generator and two-factor authentication, so even a password typed on a clever fake cannot be reused.
Frequently asked questions
What is a digital certificate in simple terms?
It is an electronic credential that proves a website’s identity and enables encryption, the SSL/TLS certificate behind HTTPS. A trusted Certificate Authority issues it after verifying the site, and your browser checks it to show the padlock.
Does the padlock mean a website is safe?
Not entirely. The padlock means your connection is encrypted and you reached the real owner of that domain, but not that the site is honest. Scammers can get certificates too, so always check the domain itself.
Should I ignore a certificate warning?
No. A certificate warning can mean an expired or invalid certificate, a misconfiguration, or an attempt to intercept your connection. Do not enter passwords or card details on a page your browser warns about.