Public Wi-Fi is safer than it used to be, but it is not something to trust blindly. Most of your traffic is now encrypted by default, so the main risks come from fake hotspots, unprotected sites and your own device settings. Good public Wi-Fi safety is mostly a handful of habits, not a technical project.
Why shared networks carry extra risk
When you join a cafe, airport or library network, you share a connection with strangers and with equipment you know nothing about. You cannot see who runs the router, how it is configured or whether anyone is watching the traffic that passes through it. On a home network you control those things. On a public one, you do not.
Some hotspots have no password at all. Others use a single password printed on a receipt, which everyone in the building also knows. A shared password does not give you a private channel; depending on the setup, other people on the network may still have an easier time than they should observing or interfering with traffic.
What an attacker can and cannot see
Years ago, anyone on an open network with the right free tool could read much of what other people sent. Today the picture is better, because most websites use HTTPS, which encrypts the conversation between your browser and the site. Our explainer on what HTTPS is and why it matters covers the details.
On a shared network, someone watching the traffic can generally still see:
- That your device is connected and roughly how much data it sends.
- The domain names your device looks up, unless DNS is also encrypted.
- The content of any connection that is not encrypted, such as an old site or an app that still sends plain data.
They generally cannot read the pages you load, the passwords you type or the messages you send over a properly working HTTPS connection. That protection is strong, which is why the old advice to avoid every public hotspot entirely is outdated.
The risks that still matter
Fake hotspots
An attacker, or just a careless neighbour, can create a network with a name like a real venue. If you join it, your traffic goes through their equipment. Encryption still protects most content, but they can attempt to redirect you to convincing fake login pages. Always confirm the exact network name with staff rather than choosing the strongest-looking signal.
Captive portals and fake sign-in pages
Many hotspots ask you to accept terms or enter an email or room number on a page before you get online. That page is normal. A page that asks for a card number, your email password or your bank login to get online is not. Real portals never need those.
Certificate warnings
If your browser shows a full-page warning about an invalid certificate, stop. On a public network that can be a sign someone is tampering with the connection. Do not click through just to get to the page.
Your own device settings
File sharing, remote access and automatic connections are convenient at home and risky in public. A laptop that offers its shared folders to everyone on the network is an easy target.
A practical public Wi-Fi safety checklist
These steps take a minute and cover most of the realistic threats.
- Confirm the network name and password with a staff member.
- When your device asks what kind of network this is, choose Public, so sharing features are switched off.
- Turn off automatic joining of open networks, so your phone does not connect to a lookalike name.
- Look for the padlock and an address starting with https before you enter anything sensitive.
- Keep your system, browser and apps updated, because many attacks rely on known flaws that patches already fix.
- Use two-step sign-in on important accounts so a stolen password alone is not enough.
- Turn Wi-Fi off, or forget the network, when you are done.
Where a VPN fits in
A VPN encrypts everything between your device and the VPN server, including traffic that would not otherwise be protected, and it hides the sites you visit from the local network. That makes it a sensible extra layer on untrusted hotspots, particularly for apps that do not use HTTPS or for people who want to keep browsing habits away from the venue.
It is not a cure-all. A VPN does not stop you typing your password into a fake page, does not remove malware and does not make you anonymous. It moves your trust from the hotspot operator to the VPN provider, so choose carefully and follow the terms of any service you use.
Using your phone instead
If you must do something sensitive, such as banking or handling work documents, consider using your phone’s mobile data or its personal hotspot feature. Your connection then travels over a mobile network rather than a stranger’s router. Protect that hotspot with a strong password, and check your mobile plan for data limits and any restrictions on tethering.
Where to start
If you only do three things, do these: confirm the network name, make sure sites use HTTPS, and keep your devices updated. Add a VPN when you are on networks you cannot vouch for. For a wider look at securing the networks you rely on every day, browse our Wi-Fi and networking guides, and if your own router is the weak link, start with how to secure your home Wi-Fi router. Public networks are fine for reading the news or checking a map; treat them with a little more care for anything that would be painful to lose.
Frequently asked questions
Is it safe to check email on public Wi-Fi?
Usually yes, as long as your email app or website uses HTTPS, which most do. Watch for certificate warnings and use two-step sign-in so a stolen password is not enough.
Is a password-protected hotspot safer than an open one?
Slightly, since traffic can be encrypted on the wireless link. But if everyone shares the same password, you still should not treat the network as private.
Can someone steal my passwords just because I am on the same Wi-Fi?
Not easily over HTTPS connections. The bigger danger is being tricked into typing credentials into a fake page or joining a fake hotspot.
Should I use my phone's mobile data instead?
For sensitive tasks it is a reasonable choice, because your traffic avoids the shared router. Check your plan for data limits and tethering rules.
