The web server then sends the Response back, also encrypted, which means that anyone ???listening in??? on the connection will just see a lot of rubbish, and thus would not be able to decipher any sensitive data such as credit card numbers or passwords.