In a nutshell
Plain HTTP sends everything as readable text, so anyone between you and the server can read or change it. HTTPS fixes this with the TLS handshake: the server presents a certificate, signed by a Certificate Authority, that proves it really is that domain, and the browser verifies the certificate chain. The two sides then agree on a shared session key over the open wire without ever sending it, and from then on every message is encrypted with that key. An eavesdropper sees only ciphertext — that locked channel is the padlock.
