You check for the padlock before entering your password. But what's it actually protecting?
HTTP sends everything as plain text. Anyone on the network can read it. HTTPS adds encryption — it scrambles the data.