Every WebSocket starts life as an ordinary HTTP request. The browser sends a GET with the header Upgrade: websocket and Connection: Upgrade, plus a random Sec-WebSocket-Key. If the server agrees, it replies with status 101 Switching Protocols and a hashed Sec-WebSocket-Accept value that proves it understood the request. This exchange is called the handshake.
After the 101 response, the connection stops speaking HTTP. The same TCP socket now carries lightweight WebSocket frames. Each frame has only a few bytes of overhead compared to the hundreds of bytes of headers a fresh HTTP request would need, so high-frequency updates stay cheap.
Frames can carry text (usually JSON) or binary data, and there are control frames for ping, pong, and close. The ping and pong frames act as a heartbeat so each side can tell the connection is still alive and clean up dead sockets. To detect broken connections faster, servers commonly send a ping every 20 to 30 seconds.
On the server you are now holding one open connection per client. A server keeping 100,000 live chat users connected is holding 100,000 sockets in memory, which is a very different scaling shape from stateless HTTP where connections come and go in milliseconds.