By default, LDAP is a plaintext protocol. Anything sent over an unencrypted connection — including a password used in a simple bind — is readable by anyone who can observe the network traffic. Before you connect to a real directory from application code, you need to understand how that connection gets encrypted.
Security
Never perform a simple bind with a real password over plain LDAP (port 389) outside of a fully trusted, isolated network. Treat it the same as sending a password over plain HTTP.
There are two distinct mechanisms for getting TLS on an LDAP connection, and it's easy to confuse them:
LDAPS wraps the entire connection in TLS from the very first byte, similar to HTTPS. It conventionally runs on port 636, and it's often the simplest option because there's no protocol-level negotiation — the client just opens a TLS connection and speaks LDAP inside it.
ldaps://dc1.example.com:636
STARTTLS starts as a normal plaintext connection on port 389, and then the client sends a StartTLS extended operation to upgrade the same connection to TLS before any bind happens. This was introduced because LDAPS was never formally standardized, while STARTTLS is defined in RFC 4513.
Both approaches end up in the same place — an encrypted connection before any credentials are sent — so the choice is largely dictated by what the server supports and organizational convention. Active Directory supports both; many OpenLDAP deployments default to STARTTLS. See STARTTLS for the client-side details, and LDAP vs LDAPS for a fuller comparison.
Encrypting the connection isn't enough on its own — the client also needs to validate the server's certificate, or the connection is vulnerable to interception despite being "encrypted." In production code, avoid disabling certificate verification (a common quick fix during local development) and instead trust the appropriate CA certificate. This is covered concretely in Production security with ldapjs.
That completes the core LDAP concepts. From here, continue into applying them with Node.js and ldapjs, or jump ahead to the Active Directory specifics if that's your target directory.