You need a Joomla powered website that can be reached via HTTP and HTTPS. Moreover you need the possibility to log in at the frontend (this is e.g. the case with the demo site delivered with Joomla).

Locate the "Login Form" module in the backend and switch "Encrypt Login Form" to "Yes". Save this setting.

Open the frontend via HTTP and scroll down until you reach the login form. Log in with any account allowed to log in at the frontend (the superuser account shall do).

Despite the setting of "Encrypt Login Form" to "Yes" the log in will be done via HTTP and not HTTPS as requested.

If you inspect the HTML source of the frontend pages you'll see that the action attribute of the form markup contains a HTTP URL and not a HTTPS URL as expected. I tested this with SEF on and SEF off setting, this makes no difference.

Up to now I found out that the mod_login module creates the login form in mod_login/tmpl/default.php by calling the JRoute::_() method with the current URL converted into a string as first argument and with the "Encrypt Login Form" flag as third argument.

I located the JRoute::_() method in libraries/joomla/application/route.php, and I see that this method returns the URL passed as first argument without moification if the following condition is true:

!is_array($url) && (strpos($url, '&') !== 0) && (strpos($url, 'index.php') !== 0)

This is the case whenever you pass a complete URL as string to this method as is the case with the login form created by the mod_login module.

I also inspected the logout form in mod_login/tmpl/default_logout.php where the JRoute::_() method is called too. In that case the current URL converted into a string is passed as first parameter too and the "Encrypt Login Form" flag is passed as third argument too.

If that piece of code should lead to switching back from HTTPS used when showing frontend pages after logging in to HTTP pages after the logout this will not work since the JRoute::_() method will return the HTTPS URL unmodified due to the same reason as for the login case.

BTW the "Encrypt Login Form" label is misleading although the tooltip helps in understanding what this setting will do (or better should do). Something like "Log In Via SSL" would be better here I think.