Does HTTPS Encrypt the URL Path and Query Parameters?
Yes, HTTPS encrypts the entire HTTP request—including the URL path, query parameters, request headers, cookies, and message body. Only the destination hostname (domain name) and port number are visible on the wire via the TLS Server Name Indication (SNI) extension.
Detailed Technical Explanation
When you establish an HTTPS connection, the TLS handshake occurs before any HTTP data is transmitted. Once the encrypted TLS tunnel is negotiated, the client sends the raw HTTP request line: `GET /search?q=secret+query HTTP/1.1`. Because this request line is inside the encrypted TLS record layer, eavesdroppers on the local network (such as Wi-Fi sniffers or ISPs) cannot see `/search` or `?q=secret+query`. They only see the IP address and the plain domain name (`example.com`) transmitted in the TLS ClientHello SNI field. However, query parameters can still leak via browser history, server access logs, and HTTP `Referer` headers.
Technical Example & Code
Comparing plaintext network visibility against the encrypted TLS tunnel.
// 1. VISIBLE ON NETWORK (Plaintext TLS SNI & IP Header):
Destination IP: 93.184.216.34
Destination Port: 443
TLS SNI: "curious-techie.com"
// 2. ENCRYPTED INSIDE TLS (Completely Invisible to Network Sniffers):
GET /account/billing?card_id=89412 HTTP/1.1
Host: curious-techie.com
Authorization: Bearer secret_jwt_token_123
Cookie: session_id=abcxyz987
Content-Type: application/json
{"amount": 49.99}Why This Is the Case (Underlying Architectural Rationale)
"In the OSI and TCP/IP protocol stack, TLS resides as a presentation/session layer between TCP (Transport) and HTTP (Application). Because the HTTP protocol message is the payload encapsulated inside encrypted TLS records, every component of HTTP (method, path, query string, headers, body) is encrypted. The destination hostname remains exposed because intermediate routing proxies and CDN servers need to know which virtual host certificate to present before decryption can occur."
Common Misconception vs Reality
"Query parameters in the URL (after the ? sign) are sent in plaintext over HTTPS."
Query strings are fully encrypted over the wire. However, putting sensitive API keys or passwords in query strings is still dangerous because URLs are frequently recorded in plaintext server access logs, browser history, and Referer headers.
Related Curious-Techie Resources
Ultimate Guide to HTTPS, TLS & Web Security →
Master TLS 1.3 encryption, certificate chains, SNI, forward secrecy, and cipher suites.
Interactive ToolURL Encoder / Decoder Tool →
Safely encode and format URI components, paths, and query string parameters.
Developer ReferenceURL Components Reference & RFC 3986 →
Related Questions in the Q&A Knowledge Base
HTTP 401 Unauthorized means the user is not authenticated (identity unknown; credentials missing or invalid), whereas HTTP 403 Forbidden means the user is authenticated (identity known), but lacks the necessary permissions to access the requested resource.
HTTP/2 multiplexes requests by splitting HTTP messages into independent binary frames tagged with a unique Stream ID. These frames are interleaved concurrently over a single shared TCP socket, eliminating the head-of-line blocking problem of HTTP/1.1.
Last-Modified is a timestamp-based cache validator with 1-second resolution, while ETag is an arbitrary content-based fingerprint (such as a hash) that accurately detects byte-level changes even when modifications occur multiple times in the same second or across distributed server clusters.
Ecossistema Técnico Relacionado e Próximos Passos
Artigos Técnicos Relacionados
What Is Transport Layer Security (TLS)?
Cryptographic transport protocol securing internet traffic above TCP.
HTTP vs HTTPS: Wire Encryption & Protocol Security
Cleartext HTTP communication compared to TLS authenticated encryption.
Troubleshooting: HTTPS Shows Mixed Content Warnings
Identify and fix insecure HTTP resource references on encrypted HTTPS pages.
Laboratórios Práticos de Diagnóstico
Especificações e Referências para Desenvolvedores
Continuar Aprendendo
HTTPS & TLS Handshake Lab
Step into the live handshake simulator to observe ECDHE key derivation and X.509 verification.