Does the padlock mean a site is trustworthy?

Does the padlock mean a site is trustworthy?

The persistent advice "look for the padlock to know a site is safe" was always a category error, and browsers have spent a decade unwinding it. A TLS (Transport Layer Security) padlock asserts exactly one thing: the connection to the server is encrypted and the server presented a certificate valid for that hostname. It says nothing about who operates the site or their intent.

The shift to free, automated issuance — Let's Encrypt issues for any hostname you control via the ACME (Automatic Certificate Management Environment) protocol, RFC 8555 — means phishing operators obtain Domain Validation (DV) certificates as trivially as anyone. Studies from the Anti-Phishing Working Group have for years reported that the substantial majority of phishing sites serve over HTTPS. The padlock is now table stakes, not a trust signal.

This is why Chrome removed the padlock icon in 2023, replacing it with a neutral "tune" glyph: usability research showed users misread it as a safety endorsement.

— DV proves control of the hostname, nothing more
— Organization/identity is not validated in DV
— Encryption ≠ legitimacy

Further reading: RFC 8555 (ACME); Chrome Security blog, "An update on the padlock icon" (2023).
Bottom line: The padlock means private, not trustworthy. Identity assurance requires looking at the certificate's validation level and the domain itself.