Explain like I'm five · Security

What is TLS?

TLS and HTTPS, told as a story about promising to exchange sealed letters with a shop in the village.

ten loaves pleasethe courier opens itBAKERYthe village bakeryon the road, anyone might read it

I send a letter to the village bakery. But the courier opens it on the way.On the road, anyone might read it. I want to send sealed letters — but the bakery and I have never met.

how do we share a seal?copied!send the seal by letter and the courier copies itBAKERYBAKERYreal bakeryfake bakerywhich one is real?no seal only we two know, and no way to tell who is real

Send the seal by letter and the courier copies it. And which bakery is the real one?We need a seal only we two know — but the road to share it is the very road we don't trust. Sealing a letter to a fake bakery is even worse.

1ID CARDBakeryvalid: next yearcheck the card first2a fresh seal, made on the spot???BAKERY③ every letter sealed from now oncheck the card, make a seal, then seal everything — the courier can't read a thing

TLS is the sealing promise between me and the shop.First I check the bakery's card, then we make a fresh seal only the two of us know, right there. From then on, every letter is sealed.

The card firstonly one stamped by the king
A fresh seal, on the spotnever sent down the road
Every letter sealedthe courier can't read it
The padlock signthe promise is in place
THE SEALING PROMISE, STEP BY STEP1me → bakery: hello! show me your card2bakery → me: here (stamped by the king)3both: mix seal ingredients, half each — the courier sees only halves4both: seal with the new stamp — every letter todayhalf is never enough to build the sealone promise, and every letter today travels sealed

The promise takes four lines. The seal never travels — each side mixes half the ingredients and builds it.The courier may overhear every word, but half is never enough to build the seal. And this seal is for today only — tomorrow we make a new one.

padlock = sealed,and the card was checkedan expired cardred lock: turn backBAKERYeven a fake bakerycan have the lockthe lock protects the letter — whether the shop is honest, read the name

The padlock protects the letter. But a fake bakery can hang a padlock too.The padlock means "sealed, and the card was checked" — not "honest shop". A fake bakery that a fake letter leads you to can get a card in its own name — so read the name.

In one breath

TLS = check the shop's card, make a fresh seal on the spot that only the two of you know, then seal every letter. The padlock says the promise is in place.

The S in HTTPS. The handshake verifies the server certificate and derives a session key through key exchange; everything after is encrypted. It stops man-in-the-middle attacks, but says nothing about whether the site is honest.

When grown-ups say it

HTTPS
A shop address with the sealing promise. When the address starts with https and shows a padlock, every letter with that shop travels sealed.
Handshake
The four lines that make the promise. Hello → card → half the ingredients each → start sealing. Done once, before the first letter.
Session key
Today's fresh seal. Made on the spot, never sent down the road, thrown away when done. Tomorrow gets a new one.
Certificate
The bakery's ID card. Trusted only with the king's seal on it. → the ID card with the king's seal
Padlock icon
The sign that the promise is in place. Sealed, and the card was checked. It does not mean the shop is honest.
Man-in-the-middle
The courier who opens the letters. Blocked by the card check and the seal. A fake card gets a red padlock. → the postman who opens your letters
Encryption
The sealed letter itself. TLS is what lets you use sealed letters even with a shop you have never met. → the letter no one reads without the key
Expiry
An expired card. The bakery's card has a date too. Past it, the browser turns you back with a red padlock.
Next story
Only the Keys You Need →
Want another term as a picture book? Request →