A browser padlock is a certificate of transport security: the words moving between you and the server are wrapped so others cannot read or edit them in transit. That is all it is.
Why it matters
- The vault is secure; the visitor is not.
- Padlock + lookalike name + urgency = the page you should not be on.
- The trustworthy signal is the domain, verified by your own typing, not by the lock.
What the padlock does
- It encrypts the data channel between your device and that site.
- It confirms the domain the certificate was issued for — so the connection really goes to the name in the URL.
- It is free and universal now; its absence is a red flag, its presence is barely a signal.
Key takeaways
- Padlock = encrypted pipe, not honest plumber.
- Verify domains by typing them, never by searching.
- Gov and bank logins go through official apps or typed addresses.
What it never proves
- It does not verify the site is genuine — a phishing clone of your bank will happily buy the same padlock technology.
- It says nothing about who runs the site or what the site does with your data.
- Name-squats like “mathura-bank-in.com versus mathurabank.in” both carry padlocks.
What you should do
- Type government and bank addresses yourself, or enter from the official app, instead of clicking search ads.
- Check the domain spelling character-by-character before entering any password or OTP.
- If unsure a government site is authentic, verify through india.gov.in rather than the page displayed.