Definition
HTTPS (Hypertext Transfer Protocol Secure) is HTTP carried over a TLS-encrypted connection. The 'S' adds three guarantees: confidentiality (an eavesdropper cannot read the request or response), integrity (an attacker cannot modify them undetected), and server authentication (the browser verifies it is connected to the genuine site, not an impersonator). Modern browsers mark non-HTTPS sites as insecure, and most of the public web is now HTTPS-only.
HTTPS vs VPN
HTTPS protects the content of your interaction with a specific website. A VPN protects all traffic leaving your device, regardless of application. The two are layered: HTTPS protects the conversation between you and example.com from everyone in between, including the VPN provider. The VPN protects metadata — which sites you visit and when — from your local network and ISP. Neither replaces the other; together they cover both content and metadata.
Limits of HTTPS
HTTPS does not hide which domain you are visiting. The DNS lookup happens in plaintext (unless you also use DoH or DoT), and the TLS handshake's Server Name Indication (SNI) field reveals the destination hostname even within the encrypted session. The Encrypted Client Hello (ECH) extension is a recent effort to close this gap. HTTPS also assumes the certificate authority system works correctly — an attacker who compromises a CA can mint valid certificates for any domain.