TLS encryption, explained

TLS is the baseline encryption protocol that secures almost all connections over the internet. It allows you to submit forms, log into your accounts, check your bank details, and make online purchases without the rest of the world looking over your shoulder. This includes your internet service provider(new window) (ISP), hotspot hosts, and hackers who may be monitoring public WiFi.

TLS establishes an encrypted connection between your device and a server, allowing the secure transfer of data. It ensures:

• Confidentiality: Your data is scrambled so only the website or server you connect to can read it.
• Integrity: Data cannot be altered mid-transit without detection.
• Authentication: You're actually talking to the real website (or server), not an imposter.

To ensure you're talking to the right server, the server presents a digital certificate that verifies it is who it says it is. These certificates are issued by Certificate Authorities (CAs) — trusted organizations that sign a certificate binding that domain to a public key.

So you don't trust the site but the CA that vouched for it. This trust is reflected in your browser’s HTTPS connection information, traditionally shown by the padlock icon in the address bar; clicking it lets you view details about the connection and certificate.

Root CAs are baked into browsers. For example, Mozilla's root store includes around 140–160 root certificates. These, in turn, verify the intermediate CAs used to verify most websites.

In general, this system works well, but it's not perfect. :There are thousands of intermediate CAs, resulting in a large attack surface. Plus, CAs can be pressured by governments(new window) or hacked by criminal organizations into issuing compromised certificates. A textbook case is DigiNotar(new window), a Dutch CA breached in 2011 by attackers who issued hundreds of rogue certificates, reportedly intercepting Gmail traffic for roughly 300,000 users, mostly in Iran.

To address these problems, modern TLS connections use Certificate Transparency (CT). This doesn't stop a CA from being hacked or coerced in the first place, but it makes the fallout far easier to catch and contain.

Every publicly trusted certificate must be logged in public, tamper-proof records the moment it's issued. Chrome, for example, has refused to trust any certificate not recorded in at least two independent CT logs since 2018.

As a result, domain owners can catch a fraudulent certificate for their site within hours instead of the weeks it took DigiNotar. Once caught, the affected certificates can be revoked quickly — and in serious cases, browsers can remove trust from the CA on their next update.

TLS combines asymmetric and symmetric encryption. Asymmetric (public-key) cryptography is used to establish the connection and let the browser and server agree on a shared secret without ever sending that secret across the network. This is called the TLS handshake.

Once a secure connection is established, the actual data is transferred using symmetric-key ciphers (typically AES). The exact encryption algorithms used are negotiated between the web server and the client, such as a browser. Most browsers allow you to click or tap on the lock icon to learn more security details about the encryption algorithms used for the HTTPS connection.

Traditional TLS doesn't hide the name of websites you connect to, as the initial handshake leaks the website's name (SNI) and other details to anyone watching. A new standard, ratified by the IETF in March 2026, aims to fix this. When it works, Encrypted Client Hello (ECH) encrypts the handshake itself, so your ISP or hotspot operators can no longer see which sites you visit. However:

• ECH only works when multiple websites share the same IP address(new window), as they do behind a content delivery network(new window) (CDN).
• If a site has its own dedicated IP, the destination remains visible.
• ECH depends on your browser using encrypted DNS (DoH) to fetch the ECH configuration keys. If this fails, connections silently fall back to plaintext SNI.
• ECH is still rolling out, and is supported in Firefox and Chrome. However, at this time, only around 9–10% of the top million websites support ECH, nearly all of which use Cloudflare.
• The CDN and DoH provider can still observe the final destination of your network connections.

TLS and end-to-end encryption both use encryption to protect your data, but they differ in who can decrypt it:

• TLS encrypts the connection between your device and a server. Once your data arrives at that server, it's decrypted there. Whoever operates the server can read it.
• End-to-end encryption (E2EE) encrypts the connection between your device and another device. Even if your data passes through servers on its journey, only the intended recipient can decrypt it.

Messages sent via Gmail are secured in transit using TLS, but are decrypted when they reach Google's servers, allowing Google to read them. Messages sent using E2EE, such as Signal messages or emails exchanged between Proton Mail users, can only be read by the intended recipient.

Both TLS and VPNs protect data in transit, but have very different purposes:

• A VPN hides which websites you visit. TLS (usually) doesn't.
• A VPN hides your DNS queries(new window). TLS (without DoH) doesn't.
• A VPN prevents websites you visit from knowing your real IP address(new window). TLS doesn't.
• A trustworthy VPN(new window) keeps no logs(new window) of your browsing history. TLS allows your ISP (and by extension your government(new window)) to snoop on and store logs of your activity.
• TLS secures connections individually, one app or process at a time. A VPN, by contrast, routes all connections from your device through the VPN tunnel (unless you use split tunneling(new window)), making it harder for an observer to infer patterns of behavior through your browser and app usage when connected to a VPN.

TLS and VPN complement each other, providing layers of protection.

TLS is the reason you can bank, shop, and log into your accounts online without every stranger on the network path watching what you do. Without it, HTTPS wouldn't exist, and neither would most of what we now take for granted about using the web.

But TLS was never designed to hide everything. It protects the content of a connection, not the fact that the connection happened. Your ISP, a WiFi hotspot operator, or anyone else watching the network can still see which sites you visit, even if they can't see what you do. Unlike E2EE, it doesn't prevent the service you are connecting to from accessing your data.

TLS, E2EE, and VPNs are therefore complementary: TLS provides baseline security, E2EE ensures only intended recipients can access your data, and a trusted VPN provides a high level of online privacy.

TLS is the protocol working behind the scenes every time you use a Proton app (with the exception of Proton VPN apps, which now mainly use WireGuard(new window)). It's what HTTPS relies on to protect your connection, and it also secures traffic in places you don't see directly, such as mail delivery between servers. But TLS only protects data while it's moving. Stronger protections, such as end-to-end encryption and zero-access encryption, are needed for truly private content.