This misunderstanding is not harmless - nearly all phishing sites use HTTPS, and therefore also display the lock icon. Despite our best efforts, our research in 2021 showed that only 11% of study participants correctly understood the precise meaning of the lock icon.

We redesigned the lock icon in 2016 after our research showed that many users misunderstood what the icon conveyed. Today, this is no longer true, and HTTPS is the norm, not the exception, and we've been evolving Chrome accordingly.įor example: we know that the lock icon does not indicate website trustworthiness. When HTTPS was rare, the lock icon drew attention to the additional protections provided by HTTPS. HTTPS was originally so rare that at one point, Internet Explorer popped up an alert to users to notify them that the connection was secured by HTTPS, reminiscent of the “Everything’s Okay” alarm from The Simpsons. The lock icon is meant to indicate that the network connection is a secure channel between the browser and site and that the network connection cannot be tampered with or eavesdropped on by third parties, but it’s a remnant of an era where HTTPS was uncommon. This is great news for the ecosystem it also creates an opportunity to re-evaluate how we signal security protections in the browser. Today, however, HTTPS has become the norm and over 95% of page loads in Chrome on Windows are over a secure channel using HTTPS.

As late as 2013, only 14% of the Alexa Top 1M sites supported HTTPS. For the last decade, Chrome participated in a major initiative to increase HTTPS adoption on the web, and to help make the web secure by default. Read on to learn about this multi-year journey.īrowsers have shown a lock icon when a site loads over HTTPS since the early versions of Netscape in the 1990s. Editor’s note: based on industry research (from Chrome and others), and the ubiquity of HTTPS, we will be replacing the lock icon in Chrome’s address bar with a new “tune” icon – both to emphasize that security should be the default state, and to make site settings more accessible.

Chromium update