The padlock has been taught as a safety signal for twenty years. Look for the padlock. Never enter your details without the padlock. It became the one piece of security advice everybody could remember, which is unfortunate, because what it actually certifies is much narrower than what people were told.
Being precise matters. The gap between what the padlock means and what people think it means is where the fraud lives.
Three things it proves, and they are all about plumbing
A certificate binds a name to a key. When your browser shows the padlock, it has confirmed that the connection is encrypted, that the name in the address bar matches a name inside the certificate, and that some issuer was willing to vouch that whoever holds the key controls that name.
That is the entire claim, and all of it is about the connection, not the company at the other end.
We read six real certificates to see what they name
We fetched the certificates from six sites and read the subject field, which names the entity the certificate was issued to.
4 of the 6 name no organisation whatsoever. Their subject is just the domain — CN=github.com, CN=dbs.com.sg. The second one belongs to a major Singapore bank, yet its certificate asserts no more than ours does — that somebody proved control of the name.
Only 2 carried a company: PayPal, Inc. and HSBC Group Management Services Limited, the latter with a jurisdiction and a business category attached. Getting one of those requires a different validation, costs real money, and involves a human checking corporate records.
Your browser shows the same padlock for all six. The distinction that took HSBC an identity check and left DBS with a name-only certificate is invisible in the interface where you make the decision.
Our own certificate cost nothing, and that is the norm
The certificate serving this page was issued by Let's Encrypt, free, automatically, in seconds. Nobody checked who we are. A machine confirmed we control the DNS for the name and issued on that basis alone.
That is not a criticism of Let's Encrypt — automatic free certificates are why almost the whole web is encrypted now, which is an enormous security win. The padlock, in other words, has stopped being a scarcity signal. It marks the presence of encryption, and encryption is now the default rather than an achievement.
Which is exactly what a lookalike domain exploits
A fraudster does not need to break the padlock. They register a name that reads like yours and get their own perfectly valid certificate for it, free, in minutes.
Look at the red lines in the figure. Two of them use nothing more exotic than a zero for an o (recato0ls.com) and a one for an l (recatoo1s.com). They are ordinary ASCII. No trick encoding, no special characters, nothing a filter would notice.
The other two are stranger. Replacing the Latin a with a Cyrillic one produces a domain your browser stores as xn--rectools-36g.com — a completely different name that can render identically to ours. A Latin s with a dot beneath it has the same effect, becoming xn--recatool-wh0d.com.
Every one of those four would display a padlock. Each certificate would be entirely genuine, correctly issued for the name the visitor is actually on. The padlock is not failing here. It is working exactly as designed, but answering a question the visitor was not asking.
Read the domain, not the padlock — and read it right to left, because the part immediately before the first single slash is the only part that identifies who you are talking to. A padlock on a name you did not intend to visit is a padlock on someone else's site, and it will look completely normal, because the certificate is real. Four of the six certificates we read name no company at all, including a bank, so the presence of a padlock tells you nothing about who is behind it. If money or credentials are involved, reach the site the way you already know — a saved bookmark, or typing the name yourself — rather than through a link that arrived asking you to.
Looking at this yourself
Everything above came from one command against a live host, and the script is committed with this guide. If you want to see what a name resolves to before you visit it, our DNS lookup shows the records behind a domain, and the IP lookup shows where the server actually sits — which is often the first sign that a familiar-looking name is hosted somewhere unfamiliar. For domain owners rather than visitors, the DMARC and SPF checker covers the email side of the same impersonation problem. Our guide on encrypted DNS explains what is protected before the connection is even made.
- All six certificates were fetched from the live hosts with
openssl s_clientand read withopenssl x509on 11 August 2026. Subjects and issuers are quoted from that output, not from any vendor's documentation. The script is committed alongside this guide and can be re-run against any host. - The lookalike domains were encoded with a standard IDNA implementation to obtain their ASCII form. They are illustrations built for this article — we have not registered any of them, and none is known to exist.
- ⚠️ A certificate's contents can change at any renewal. DBS and GitHub named no organisation on the date we looked; either could issue differently tomorrow, and the point stands regardless of which specific sites are in which column.
- ⚠️ We did not test how any particular browser renders a mixed-script domain. Modern browsers apply their own rules, and several would display the punycode form rather than the lookalike. That mitigation is real, it varies by browser and by script combination, and it is not something this guide measured.
This describes what a TLS certificate asserts in ordinary web browsing. It is not a judgement about the security of any site named, all of which were chosen as familiar examples of certificates in current use.
View author profile → · Editorial policy
