HTTPS is plain HTTP wrapped inside an encrypted TLS connection. HTTP sends everything as readable text over the wire. HTTPS scrambles it so anyone in between sees only noise.
That layer does three jobs. It hides the content from eavesdroppers. It proves you reached the real server, not an impostor. It detects any tampering with the bytes in transit.
This matters because networks are full of untrusted hops: coffee-shop WiFi, ISPs, proxies. Without HTTPS, passwords and cookies travel in the clear. Browsers now mark plain HTTP pages as not secure, so HTTPS is the default. That is why login pages and payment forms always use it.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
