Before any encrypted data flows, the browser and server perform a handshake: they agree on how to encrypt, the server proves its identity with a certificate, and together they establish keys that only the two of them know.
The clever part is using public-key cryptography just long enough to exchange a shared secret, then switching to fast symmetric encryption for everything after. That handshake is the padlock in your address bar, and it happens in milliseconds on every HTTPS connection.