iCloud Private Relay: HTTP vs. HTTPS Protection in Safari

This article explains the differences in how Apple’s iCloud Private Relay protects unencrypted HTTP traffic compared to encrypted HTTPS traffic within the Safari web browser. While Private Relay masks your IP address and secures your DNS requests for both protocols, it does not protect the actual data payload of HTTP and HTTPS traffic equally from end to end. Below is a straightforward breakdown of how the feature handles each protocol, the mechanics of its dual-hop architecture, and where security vulnerabilities still exist for unencrypted websites.

The Short Answer

No, iCloud Private Relay does not protect HTTP and HTTPS traffic equally. While Private Relay significantly upgrades the security of HTTP traffic on your local network, HTTPS traffic remains far more secure because it is encrypted all the way to the final destination, whereas HTTP traffic must eventually be decrypted before reaching the website.

Understanding the Two-Hop Architecture

To understand the difference in protection, you must first understand how iCloud Private Relay routes your Safari traffic. It uses a "two-hop" system:

1. The First Relay (operated by Apple): Knows your real IP address, but cannot see the website you are visiting.
2. The Second Relay (operated by a third-party partner like Cloudflare or Akamai): Sees the website you are visiting and assigns you a temporary IP address, but does not know your real IP address or identity.

For both HTTP and HTTPS traffic in Safari, this system successfully hides your browsing history from your Internet Service Provider (ISP) and hides your real IP address from the websites you visit. The difference lies in how the actual content of the web pages is protected during this journey.

How HTTPS Traffic is Protected

When you visit an HTTPS website in Safari, your connection is protected by end-to-end encryption.

• From your device to the First Relay: Encrypted.
• From the First Relay to the Second Relay: Encrypted.
• From the Second Relay to the Website: Encrypted.

Because HTTPS is natively encrypted, neither your ISP, Apple, nor the third-party operator of the Second Relay can see the content of the pages you are viewing or the data you are entering (such as passwords or credit card numbers). The encryption is only unlocked by the final website's server.

How HTTP Traffic is Protected

Standard HTTP traffic is completely unencrypted, meaning anyone intercepting the connection can read the data in plain text. When you use Safari with iCloud Private Relay enabled, Apple steps in to temporarily secure this vulnerable traffic.

• From your device to the First Relay: Encrypted by Private Relay.
• From the First Relay to the Second Relay: Encrypted by Private Relay.
• From the Second Relay to the Website: Unencrypted.

Private Relay wraps your unencrypted HTTP traffic in a protective layer of encryption before it leaves your device. This means hackers on a public Wi-Fi network, your ISP, and Apple (the First Relay) cannot read the HTTP data.

However, because the destination website only supports unencrypted HTTP, it cannot understand encrypted data. Therefore, the Second Relay must strip away Apple's encryption and send the data over the open internet in plain text to the final website.

The Security Gap

The inequality between HTTP and HTTPS on iCloud Private Relay happens at the Second Relay.

When using HTTPS, the Second Relay simply passes along a locked box of data that it cannot open. When using HTTP, the Second Relay has to unlock that box to hand the contents to the website. Consequently, the third-party company operating the Second Relay can technically view your unencrypted HTTP traffic, as can any malicious actors monitoring the network connections between that Second Relay and the final website server.

While iCloud Private Relay prevents your identity (IP address) from being tied to that unencrypted HTTP data, the data itself becomes vulnerable to interception during the final leg of its journey. Therefore, you should never enter sensitive information on an HTTP website, even with iCloud Private Relay turned on.