TLS is the negotiation underneath HTTPS: the certificate exchange, the key derivation, the cipher selection. It is what lets two parties who have never met agree on a private channel in milliseconds.
In plain language
When a browser visits an HTTPS site, it and the server first run a short handshake: they prove who they are with certificates, agree on the encryption to use, and derive a shared key. After that, everything you send is unreadable to anyone listening in the middle. The padlock icon in the address bar is shorthand for 'TLS finished without complaints.'
An everyday picture
Think of TLS as a lock on a door. Boring when it works, suddenly the loudest thing in the room when it doesn't. The goal is for it to stay boring.
Where it shows up
TLS runs in the background of any product that handles login, payment, or private data. It is most visible the moment it fails, when someone gets in who shouldn't, or someone is locked out who shouldn't be.
A small example
When you log in to a bank, TLS keeps your password out of the hands of anyone on the same Wi-Fi network. The bank's certificate is what assures your browser it is talking to the real bank.
Common misunderstanding
One line to take with you
TLS is a quiet promise. Keep the promise small, write it down, and check it works.
Frequently asked
They do the same job, but they are not the same thing. SSL is the older name and the older protocol; it was retired because of security flaws. Everything in use today is TLS, currently version 1.3. People still say SSL out of habit, and many tools keep the word in their names, but the protocol actually running is TLS.
The padlock means TLS finished its handshake: the connection is encrypted and the server presented a certificate your browser trusts. It does not mean the site itself is honest or that its operator is trustworthy. A scam site can still serve valid TLS. Read the padlock as proof that nobody on the network is reading your traffic, not as a verdict on the people behind the site.
Most TLS failures are not clever attacks; they are expired certificates and misconfiguration. Certificates usually last a year or less and must be renewed, and a missed renewal can take a whole site down. Allowing old versions like TLS 1.0 and 1.1 or weak cipher suites is the other common gap. Automating renewal with tools like certbot or a cloud certificate manager, and following a standard configuration guide, removes most of the risk.