Plain HTTP travels like a postcard: every router, Wi-Fi owner and provider on the way can read it, or even change it. HTTPS seals it, so only your browser and the real server can read what is inside.