What Happens During a TLS Handshake (Step-by-Step, No Jargon)

TLS is the handshake that protects almost every modern web request. If you have ever wondered what actually happens behind the browser lock icon, this is the clean version.

The Goal of TLS

TLS creates:

• Confidentiality (no one can read your traffic)
• Integrity (no one can tamper with it)
• Authenticity (you are talking to the right server)

The Handshake in Steps

1. Client Hello

The browser says:

• TLS version
• supported cipher suites
• a random nonce

2. Server Hello + Certificate

The server replies with:

• chosen cipher suite
• its certificate (public key + identity)

The browser verifies the certificate chain.

3. Key Exchange

Modern TLS uses ECDHE. The browser and server exchange ephemeral keys and derive a shared secret.

4. Session Keys

Both sides compute symmetric keys. From here on, encryption is fast.

5. Secure Communication

All HTTP data is encrypted with symmetric keys.

Why HTTPS Is Fast Today

• Symmetric encryption is cheap.
• TLS 1.3 reduces round trips.
• Session resumption avoids full handshakes.

Final Thought

TLS is complex under the hood but elegant in effect. It lets the web be both fast and secure without most users noticing. That is good engineering.