Encryption, HTTPS, and VPNs Explained Visually
Encryption gets described in mysterious terms, but the core idea is simple: scramble a message so that only someone holding the right key can read it. Once you see that clearly, HTTPS and VPNs stop being magic and become two practical applications of the same basic tool.
Updated 2026-08-06
The idea in one picture
Encryption takes a readable message and a secret key, and produces scrambled output that looks like nonsense to anyone without that key. The same key (or a matching one) can reverse the process and recover the original message. Anyone intercepting the scrambled version in the middle — on public wifi, on a shared network, anywhere in between — sees only noise.
HTTPS: encryption for a single website
When you see a padlock in your browser's address bar, it means the connection between your device and that specific website is encrypted using HTTPS. Nobody sitting on the same network as you — a coffee shop wifi, an airport hotspot — can read what you send or receive from that site, even though they can see that you are connected to it. Without HTTPS, anything you type on a plain HTTP site, including passwords, travels in plain readable text.
The padlock is not a trust seal
HTTPS means your connection to a site is private — it does not mean the site itself is honest or safe. A scam site can have a padlock too. Never confuse "encrypted" with "trustworthy."
VPNs: encryption for everything you send
A Virtual Private Network (VPN) encrypts all of your device's internet traffic and routes it through a server you trust, rather than encrypting just one connection to one website the way HTTPS does. This hides your traffic from your local network and your internet provider, and it also makes your traffic appear to originate from the VPN server's location instead of your own.
A VPN is most valuable on networks you do not control or trust — public wifi being the classic example — where it protects any traffic that is not already using HTTPS, and adds a layer of privacy even for traffic that is.
Two locks, two different jobs
- HTTPS protects your connection to one specific website you are visiting.
- A VPN protects your connection from your device out to the wider internet, for everything you do.
- They are not competitors — most careful users benefit from both, layered together.
- Neither one hides what you do once your traffic reaches its destination — a website you're logged into still knows it is you.