Why HTTPS

Everything so far travelled as plain text. That is not a figure of speech: the request line, your headers and your body go over the wire exactly as typed, and anyone positioned along the way can read them.

You already have the tool to prove it. Point a listener at your own request and look at the body: a password sent over plain HTTP is sitting there in full.

HTTPS is the same HTTP wrapped in TLS, a layer that encrypts the conversation before it leaves your machine. An observer still sees that you connected to a host, and roughly how much data moved, but not the path, the headers or the body.

It does one more thing that matters just as much: it proves the server is who it claims to be. Encryption alone would let you have a beautifully private conversation with an impostor.