Public Wi-Fi is much safer than it was ten years ago, because almost every website and app now uses HTTPS encryption. It is still a network you do not control, shared with strangers and run by someone you do not know. A few habits remove most of the risk.
The real risks
| Risk | What happens |
|---|---|
| Fake hotspots ("evil twin") | An attacker creates a network called "Airport_Free_WiFi" and sees or redirects your traffic |
| DNS manipulation | The network answers lookups with fake addresses to send you to phishing pages |
| Snooping on unencrypted traffic | Anything not using HTTPS (some old apps, http:// sites) can be read |
| Captive portal phishing | A fake login page asks for your email password or card details |
| Attacks from other users | Devices on the same network can probe yours if file sharing or open ports are enabled |
| Tracking | The operator logs which sites you visit and links them to your device |
How to protect yourself
- Use a VPN. It encrypts everything between your device and the VPN server, so the Wi-Fi operator and other users see nothing useful. See what is a VPN.
- Check the network name with staff and avoid similarly named open networks.
- Look for HTTPS (the padlock) before entering passwords, and never ignore a certificate warning.
- Turn on encrypted DNS to stop DNS manipulation. See DNS over HTTPS.
- Mark the network as public. Windows asks; choose Public network so file sharing and discovery stay off. On Mac, keep the firewall on.
- Turn off auto-join for open networks, so your phone does not connect to look-alike hotspots.
- Use two-factor authentication on important accounts, so a stolen password is not enough.
- Use mobile data for banking if you have no VPN.
Captive portals
The page that asks you to accept terms or enter a room number is a captive portal. It is normal, but it should never ask for your email password, social media login or full card details unless you are paying for access on a known provider's page.
After using public Wi-Fi
- Tell your device to forget the network if you will not return.
- Check that your VPN did not leak.
Frequently asked questions
Can someone see my passwords on public Wi-Fi?
Not on HTTPS sites and modern apps, which encrypt them. The danger is fake login pages, so check the address bar.
Is hotel Wi-Fi safer than café Wi-Fi?
Not necessarily. A password on the network only keeps outsiders out; other guests share it.
Is my phone's hotspot safer?
Yes. A personal hotspot with a strong password is a network you control.