Is Public Wi-Fi Safe? What Actually Puts You at Risk

For years, the standard advice was simple: never use public Wi-Fi for anything important. That warning made a lot of sense when most websites sent information in plain text. Today the picture is different. Most of the web now runs over encrypted connections, which removes the biggest danger people used to worry about — but it doesn't make every free hotspot harmless. The risks have shifted, and knowing where they actually are is more useful than avoiding public networks altogether.

What changed: encryption is now the default

When a site uses HTTPS, the connection between your device and that site is encrypted. Someone else on the same café network may be able to tell that you're connecting to a particular service, but they can't read the pages you load, the passwords you type, or the messages you send. Banking apps, email providers, social networks and popular messaging apps all encrypt their traffic as a matter of course. Browsers also warn loudly when a site isn't secure, and many now try to upgrade connections to HTTPS automatically.

That means the classic picture of a stranger at the next table quietly reading your emails is far less realistic than it used to be.

The risks that still matter

• Fake networks — an attacker can set up a hotspot named after the venue, often called an “evil twin”, and wait for people to join it
• Fake login pages — once someone controls the network, they can redirect you to a convincing copy of a sign-in page and collect whatever you type
• Captive portals that ask too much — a Wi-Fi sign-up page that wants your email password or card details is a red flag, not a normal step
• Open file sharing — laptops set to share folders or allow discovery on a “home” network can expose more than you intend on a public one
• Out-of-date devices — an unpatched phone or laptop is easier to attack on any network, and public ones put you next to more strangers

Why the network name isn't proof of anything

Anyone can name a hotspot anything they like. Two networks with the same name, or a suspiciously generic one like “Free Airport WiFi”, are worth a second look. If you're not sure which network is official, ask staff or check a sign at the venue before connecting.

Simple habits that cover most of the risk

• Check for the padlock or the site's normal address before entering a password, and back out if your browser shows a certificate warning
• Prefer apps over browser logins for banking and email, since apps connect directly to the service rather than through a page you might be redirected away from
• Mark public networks as “public” when your laptop asks, which turns off device discovery and file sharing
• Turn off auto-join for networks you only used once, so your device doesn't reconnect to a look-alike later
• Keep your operating system and browser updated

Where a VPN or hotspot fits in

A reputable VPN encrypts everything leaving your device and sends it through a server you've chosen, so the local network sees very little. It's a sensible extra for frequent travellers or anyone who regularly works from cafés. Using your phone's own hotspot is another easy option — it's a network you control, which sidesteps the fake-network problem entirely.

Public Wi-Fi isn't the danger it once was, but it rewards a little attention. Join the right network, watch for odd login pages and warnings, and keep your devices updated, and you've dealt with the risks that actually matter.

Frequently Asked Questions