Why doesn't the padlock mean a site is "safe"?

Why doesn't the padlock mean a site is "safe"?

What does the browser padlock actually assert? Only that the connection to the server is encrypted and the certificate chains to a trusted root — nothing about the operator's honesty. The padlock attests to transport security (TLS = Transport Layer Security), not application trustworthiness.

This is settled, not speculative. By 2021 the Anti-Phishing Working Group reported the large majority of phishing sites served valid HTTPS, because domain-validated certificates from Let's Encrypt are free and issued in seconds. A padlock on a lookalike domain is fully legitimate TLS.

What the padlock genuinely rules out:

— A passive eavesdropper reading credentials on the wire
— A man-in-the-middle tampering with the page in transit

What it does not rule out:

— The domain itself being attacker-controlled
— Malware or fraud served over that encrypted pipe

This is precisely why browsers removed the "Secure" wording and the green EV (Extended Validation) bar around 2019: usability studies (Google/Mozilla telemetry) showed users misread it as a safety endorsement.

Further reading: APWG Phishing Activity Trends Reports; Chromium's 2018–2019 security-indicator design notes.

Bottom line: the padlock proves how data travels, never who you are talking to or what they intend. Read the domain, not the icon.