Is Public Wi-Fi Safe? The Real Risks and How to Stay Protected

You’re at the airport with an hour to kill, or you’ve just checked into a hotel, and a free network is waiting. You want to check your bank balance, answer a work email or book a ride. So, is public Wi-Fi safe enough for that?

For most everyday browsing, yes. Public Wi-Fi is far safer than it was a decade ago, because the vast majority of websites and apps now encrypt their connections. But real risks remain, and today they’re mostly about being tricked rather than being spied on.

Below, you’ll find the public Wi-Fi risks that still matter, what HTTPS does and doesn’t protect, and a 12-point checklist you can use anywhere.

Is public Wi-Fi safe today?

Public Wi-Fi used to be genuinely risky. Many sites encrypted only their login page, and everything else, including the cookies that keep you signed in, crossed the network as readable text. In 2010, a free browser add-on called Firesheep showed how easy it was to take over other people’s social media sessions on a shared network with a couple of clicks.

Since then, the web has moved to HTTPS, the encrypted version of the protocol your browser uses to load pages. Free certificate authorities such as Let’s Encrypt removed the cost of switching, browsers started labeling unencrypted pages “Not secure,” and phone platforms now steer apps toward encrypted connections by default.

So reading your email from the next table is now much harder to pull off. What’s left is subtler: attacks that trick you, and gaps HTTPS was never designed to close.

Public Wi-Fi risks that still matter

Here’s what can still go wrong.

Evil twin and rogue hotspots

An evil twin is a fake hotspot made to look like a real one. Anyone with a laptop can broadcast a network called “Airport Free WiFi,” and your phone can’t tell it from the genuine one by name alone. A rogue hotspot is the broader category: any unauthorized network, copycat or not.

Once you connect, the attacker controls your route to the internet and can watch which sites you visit or show you fake sign-in pages. Your device may even join automatically if the fake uses the name of an open network you’ve joined before.

Open networks without Wi-Fi encryption

When a network has no password, the wireless link usually isn’t encrypted, so anything your device sends without its own encryption, such as a plain HTTP page, can be captured by anyone nearby with the right software.

A password helps less than you’d think. One printed on a sign or handed to every guest keeps outsiders off the network, not the stranger at the next table who has it too. Newer standards (WPA3, and Wi-Fi Enhanced Open for networks without a password) make eavesdropping by other users much harder, but you can’t count on them in public.

Man-in-the-middle attacks

In a man-in-the-middle (MITM) attack, someone slips between you and the internet so your traffic flows through them. On a local network, a common technique is ARP spoofing, where the attacker’s device falsely claims to be the router.

An attacker in the middle can read and change anything that isn’t encrypted. Against HTTPS, they’re mostly limited to seeing which sites you connect to, unless they trick you into accepting a fake security certificate, which is why certificate warnings matter so much.

DNS hijacking and redirects

Before loading a website, your device looks up its numeric address using DNS, the internet’s address book. On public networks, those lookups usually go to a server picked by whoever runs the network, often unencrypted.

A malicious hotspot can answer the lookup for your bank with an impostor’s address. HTTPS usually catches this, because the impostor can’t present a valid certificate for the real site, so your browser warns you. The danger is on pages without HTTPS, or if you click past the warning. DNS can also trip you up on a VPN, as our guide to DNS leaks and how to test for them explains.

Malicious captive portals and fake login pages

A captive portal is the sign-in page that appears before you get online, asking you to accept terms or enter a room number. Because it pops up automatically and looks official, it’s a perfect disguise for phishing.

A fake portal might ask for your email password, request card details on a network that’s supposed to be free, or tell you to install an app or a “security certificate.” On a free network, a genuine portal rarely needs more than a click, a room number and surname, a voucher code or an email address.

Apps that still send data unencrypted

HTTPS protects web pages, but not everything on your device is a web page. Some older apps and email accounts set up years ago still send data without encryption, readable by the network operator and potentially others nearby.

You can’t easily check every app, which is one of the strongest arguments for a VPN on public Wi-Fi: it encrypts everything it carries to the VPN server, whether or not each app bothered to.

Other devices on the same network

Joining a network puts your device in the same space as everyone else on it. A laptop set up for home may be sharing folders or a media library and announcing itself through network discovery. Some networks use client isolation, which stops connected devices from talking to each other, but you can’t tell whether it’s on.

AirDrop and similar nearby-sharing features don’t use the hotspot at all, but in a crowded place they can still show your device name to strangers or let them send you unsolicited files.

What HTTPS protects on public Wi-Fi (and what it doesn’t)

HTTPS is the biggest reason public Wi-Fi security has improved, so it’s worth knowing where its protection ends. When a site’s address starts with https://, usually with a padlock or similar icon beside it, your connection to that site is encrypted.

HTTPS hides from others on the network:

• The contents of the pages you view
• What you type, including passwords, messages and card numbers
• Which specific pages you open on a site, such as a particular article or search
• The cookies that keep you signed in

HTTPS doesn’t hide or prevent:

• Which sites you visit. A site’s name usually leaks through DNS lookups and the name your browser announces when it opens the secure connection, and the server’s IP address is visible.
• When and how much. The timing and volume of your traffic are visible.
• Fake login pages. A phishing site can have a perfectly valid certificate for its own lookalike address. The padlock means the connection is encrypted, not that the site is honest.
• Apps that don’t use it, or anything you send after clicking through a certificate warning.

For how the scrambling works, see what encryption is and how it works.

Public Wi-Fi risks at a glance

How to stay safe on public Wi-Fi: a 12-point checklist

1. Confirm the exact network name with staff. Ask at the counter, and watch for near-duplicates with an extra word or a missing hyphen.
2. Use your phone’s hotspot for sensitive tasks. Mobile data isn’t shared with strangers the way coffee shop Wi-Fi is, so it’s better for banking or work. Give the hotspot a strong password.
3. Use a VPN. It wraps your traffic in an encrypted tunnel to the VPN server, hiding it from the network owner and other users. New to VPNs? Start with what a VPN is and how it works.
4. Turn off auto-join. On an iPhone, tap the info button next to the network and switch off Auto-Join; on Windows, untick Connect automatically when you join, so your device can’t quietly hop onto a lookalike later.
5. Forget the network when you leave. Choose Forget in your Wi-Fi settings so your device won’t rejoin anything using that name.
6. Set the network to Public on Windows. This hides your PC from other devices and turns off sharing. In Windows 11, open Settings > Network & internet > Wi-Fi, choose the network’s properties and set Network profile type to Public network.
7. Turn off file sharing and AirDrop discovery. On a Mac, review System Settings > General > Sharing. Set AirDrop to Contacts Only or turn receiving off, and do the same for Quick Share on Android.
8. Keep your software updated. Updates close the security holes attackers look for, so install pending ones before you travel.
9. Turn on two-factor authentication (2FA). Then a stolen password alone won’t get anyone into your account. An authenticator app or security key beats text-message codes.
10. Never click through certificate warnings. A full-page “Your connection is not private” warning on a well-known site is what an attack would look like from your side. Close the tab and use mobile data.
11. Keep your firewall on. Windows turns its firewall on by default, so just check it hasn’t been switched off. On a Mac, look in System Settings > Network > Firewall.
12. Log out when you’re done. Sign out of sensitive accounts, close the browser, and never stay signed in on a shared computer.

Hotel Wi-Fi safety and captive portals

Hotels, airports and trains usually put a captive portal in front of their Wi-Fi. Until you’ve passed it, the network blocks most traffic, including your VPN’s attempt to connect.

At a hotel, also be wary of a portal that asks for passwords or card details you didn’t expect, and keep banking off the business-center computer. For the rest of your trip, see our travel cybersecurity tips.

Do you need a VPN on public Wi-Fi?

Not strictly, for everyday browsing, but a VPN is the simplest way to close several of these gaps at once. It creates an encrypted tunnel between your device and a VPN server, so the hotspot owner, other users and anyone running an evil twin see only scrambled data heading to one address.

That covers unencrypted app traffic, the list of sites you visit and DNS tampering. It won’t stop you from typing a password into a phishing page, protect an infected device, or make you anonymous to sites you sign in to. Our guide on when a VPN helps and when it doesn’t goes deeper. And incognito mode is no substitute for a VPN: it only controls what’s saved on your own device.

The bottom line

Thanks to HTTPS, public Wi-Fi is far safer than its reputation for everyday browsing. The remaining risks are about deception and exposure, so confirm the network, keep your devices updated and locked down, never click through certificate warnings, and use a VPN on networks you don’t control.

If you want that extra layer without paying, OqusFreeVPN is 100% free, with no ads and no account needed, and it’s built on the WireGuard protocol. Apps for Windows, macOS, Android, iOS and Linux are rolling out in Early Access, and you can read how OqusFreeVPN approaches security.