What the HTTPS padlock means: how your browser talks in secret on a Wi-Fi anyone can read

You pay for something on the free Wi-Fi of a café. The stranger at the next table can catch a copy of every packet your phone sends. With HTTPS, he cannot read any of them. He also cannot stand in the middle and pretend to be the shop. The padlock is built from a few real pieces, and you meet each one: encryption, the Diffie-Hellman key exchange, the man-in-the-middle attack, private and public keys, certificates and the authorities your phone trusts, the TLS handshake, forward secrecy, and what the padlock never hides.