Sometime around 2019 the padlock icon stopped meaning anything, and almost nobody who relied on it noticed.
For years, security advice had a comfortable shortcut buried in it: look for the padlock, look for https://. Banks put it on their login pages. Awareness training put it on the slide. It worked well enough that people internalized it as the signal — padlock means safe, no padlock means careful. That advice was always slightly wrong, and for a while it didn’t matter, because reality happened to line up with it. Then reality stopped lining up, and the advice was still out there, doing damage.
The accidental signal
Here’s the thing the padlock actually told you: the connection between your browser and whoever controls this domain is encrypted, and the certificate was issued to someone who proved they control the domain. That’s it. It never said the site was honest. It never said the company behind it was real. It said the bytes are encrypted in transit and the name matches.
But before certificates were free, that narrow technical fact had a useful side effect. Getting a certificate cost money and hassle. You paid a CA, you sometimes waited on a human to validate you, you fought with OpenSSL. A criminal spinning up a throwaway PayPal-lookalike to harvest credentials over a weekend usually didn’t bother. Why pay for a cert on a domain you plan to burn in 48 hours? So phishing kits mostly ran on plain http://, and the padlock became a rough, unearned proxy for “someone spent effort here.”
It was never encoding trust. It was encoding cost. And the moment you remove the cost, the proxy collapses.
Let’s Encrypt removed the cost
Let’s Encrypt went to general availability in April 2016 with an explicit, admirable mission: encrypt the entire web. Free certificates, fully automated, issued in seconds by a machine after a domain-validation challenge. No credit card, no waiting on a human, no OpenSSL wrestling match. It worked spectacularly. HTTPS adoption across the web went from a minority of page loads to the overwhelming default in a handful of years, and Let’s Encrypt is a big part of why. That is a genuinely good thing. Encryption in transit should be free and universal, full stop.
The criminals got the same deal. A domain-validated certificate proves exactly one thing — that the requester controls the domain — and a phisher who just registered paypa1-secure-login.com controls it completely. The validation isn’t fooled; there’s nothing to fool. DV was doing its job perfectly. It just turns out its job has nothing to do with whether the site is a scam.
The numbers followed immediately. In early 2017 Netcraft counted well over fourteen thousand Let’s Encrypt certificates issued to domains containing “PayPal” — almost all of them phishing. By the second quarter of 2020, the APWG’s data had roughly 80% of phishing sites serving HTTPS. By the first quarter of 2021 it was 83%, and — this is the part that stings — that was the first time the number plateaued since researchers started tracking it in 2015. It didn’t plateau because phishing got less sophisticated. It plateaued because it had run out of room to grow. Nearly every phishing site already had the padlock. Around nine in ten of those certificates were domain-validated — the free, instant kind.
So the padlock, the thing a decade of training told people to look for, now sat on the phishing page too. The signal didn’t just weaken. It inverted for the exact population it was supposed to protect: the non-technical user who was taught that the lock means safe now saw the lock on the page designed to rob them.
Whose fault is this, actually
The easy villain is Let’s Encrypt, and the easy villain is wrong.
Let’s Encrypt thought about this out loud, in public, before most of the criticism arrived. Back in 2015, before they’d issued a single production certificate, Josh Aas wrote a post laying out the position: a certificate authority is a bad place to fight phishing and malware. CAs don’t have ongoing visibility into what a site actually serves — they see a domain-control challenge at one instant and nothing after. Organizations like Google and Microsoft, who crawl and classify the whole web continuously, do have that visibility, and browsers already ship their verdicts through Safe Browsing and SmartScreen. His line was blunt: the fight against phishing matters, but it doesn’t make sense for CAs to be on the front lines, at least for DV certificates.
They even tried the compromise for a while. Early on, Let’s Encrypt checked domains against the Google Safe Browsing API before issuing, and refused domains that were already flagged. In January 2019 they stopped, and the reasoning is the strongest evidence they were right all along: it didn’t help. By the time Safe Browsing has flagged a domain, the certificate has usually already been issued — phishing infrastructure is fast, and issuance is instant. Checking at issuance time was catching almost nothing while adding cost and a false sense that the CA was a meaningful filter. Blocking a certificate doesn’t take a phishing site down anyway; it just makes it serve plain HTTP, which is where it started. You’ve spent effort to move a scam back one square.
If you want to blame something, blame the decade we spent telling users the padlock meant “safe.” That was the actual error — not the free certificate, but the marketing wrapped around it. Browsers sold it too. Chrome literally printed the word “Secure” next to the padlock for years, which is about the most misleading single word you could attach to “the transport is encrypted.” They dropped the “Secure” text in 2018 and eventually replaced the padlock itself with a neutral icon in 2023, quietly conceding that the symbol had been teaching people the wrong lesson the whole time.
The uncomfortable takeaway
Free TLS didn’t make phishing technically easier. Phishing was never gated on encryption; it’s gated on someone clicking a link and typing a password into the wrong box. What free TLS did was strip away a coincidental discriminator — the cost of a certificate — that users and trainers had quietly promoted into a trust signal it was never designed to be.
This is worth sitting with, because the same mistake is everywhere in security. We lean on side effects. A thing that’s expensive, or rare, or requires effort becomes a proxy for “legitimate,” and we build habits and advice on top of the proxy instead of the underlying fact. Then the cost drops — because someone, correctly, made a good thing cheap and universal — and every habit built on the old scarcity quietly breaks.
The padlock still means precisely what it always meant: the connection is encrypted and the name matches. It is a statement about plumbing, not about honesty. The lesson of free certificates isn’t that we should have kept them expensive. It’s that we should stop mistaking the price of a thing for proof of its character — and stop teaching users to do the same.