How to Stay Safer on Public Wi-Fi

Public Wi-Fi is convenient, and for most everyday use it is fine. But it is a network somebody else runs, shared with strangers, and you cannot check how it is set up. This guide separates the realistic risks from the exaggerated ones, then lists habits that make the biggest difference.

Why public Wi-Fi is different from home Wi-Fi

At home, you know who set up the router, you chose the password, and the devices on the network are yours. In a cafe, airport or hotel:

• You do not know who configured the network or how well it is maintained.
• Many strangers are connected at the same time.
• The network may have no encryption, or one shared password given to everyone.
• The login page you see may not be what you think it is.

None of this means every café is dangerous. It means the sensible assumption is "trust it only as far as you have to". The FTC guidance on public Wi-Fi takes a similar view.

The realistic risks

Snooping on unencrypted traffic

On an open network with no encryption, a person nearby with simple software can see data sent in the clear. Years ago this covered most websites. Today most sites use HTTPS (what HTTPS is), which encrypts the connection between your browser and the site. But not everything is covered: some older sites, some app traffic and some messages may still be plain.

Fake hotspots ("evil twins")

An attacker, or an opportunist with a laptop or phone, can create a network with a name that looks right, such as "Airport Free WiFi" or a variation of a cafe name. People connect automatically, and all traffic then passes through the attacker's device. If the traffic is HTTPS or VPN-encrypted, the attacker still cannot read the content, but they can attempt to redirect you to fake pages.

Fake login portals and phishing

Many public networks ask you to open a page and enter an email address, room number or "sign in". A fake network can show a page that asks for far more, such as a password or card details. Phishing, whether on Wi-Fi or elsewhere, is a leading cause of account loss. See how to recognize phishing websites.

Files and devices exposed on the local network

If file sharing is on, or a device has a weak setting, other devices on the same network may be able to see or try to reach it. This is one reason to treat public networks differently from private ones.

What is less of a risk than people think

Reading about public Wi-Fi often suggests hackers can read everything you do. With HTTPS almost everywhere, passively reading your banking session is much harder than headlines suggest. The more common problems are fake networks, phishing and poor device settings, which is why habits matter as much as technology.

Habits that matter most

1. Confirm the network name. Ask staff for the exact name. If you see several similar names, such as "CafeWiFi" and "Cafe_WiFi_Free", ask which is real.
2. Prefer mobile data for sensitive tasks. Banking, tax and account recovery are best done on your phone's mobile connection or at home.
3. Look for HTTPS. The padlock in the address bar means the connection to that site is encrypted. If a browser warns about a certificate, stop and do not click through.
4. Turn off automatic connection. Stop your phone and laptop from joining open networks by themselves, and "forget" networks you will not use again.
5. Turn off file sharing and AirDrop-style visibility unless you need them. Set the network type to "public" if your operating system asks.
6. Use two-factor authentication. Even if a password is captured, the second step blocks most misuse. Why a second factor helps is covered by CISA.
7. Keep software updated. Updates fix flaws that attackers rely on.
8. Log out of important accounts when you finish, especially on shared computers, and never save passwords on a computer you do not own.
9. Be careful with login prompts. A page that appears after connecting should ask for little. If it asks for your email password, close it.

Where a VPN fits

A VPN encrypts traffic between your device and the VPN server, as well as changing the IP address sites see. On a public network, that means:

• Other users on the Wi-Fi cannot read your traffic, even where a site uses plain HTTP.
• The Wi-Fi owner sees a connection to the VPN server rather than the sites you use.
• A fake hotspot cannot read the content of VPN-protected traffic.

What it does not do: it does not stop you entering your password on a phishing page, it does not remove malware, and it cannot make an untrustworthy site trustworthy. The relationship between the two layers is explained in HTTPS vs VPN. If you want to use one on the go, how to connect to a VPN on public Wi-Fi gives the steps, and the VPN for public Wi-Fi page covers this use case.

Order of steps at the airport

A reasonable routine when you land and need to get online:

1. Ask for or look up the official network name.
2. Join that network only.
3. Before opening anything important, connect your VPN.
4. Confirm the VPN shows as connected.
5. Do your tasks, and log out of accounts afterwards.
6. When finished, disconnect, and tell your device to forget the network if you will not return.

A worked example

Jonas is at a train station and needs to approve a payment from his bank app. He sees two networks: "Station_Free" and "Station-Free-WiFi". He checks a sign on the wall, which gives the second name. He joins it, and a login page asks only for his email address, which is normal. He connects his VPN, opens the bank app, and the app asks for a code from his authenticator. The payment goes through. If the page had asked for his bank password, he would have left and used mobile data.

Limits and what to watch for

• A VPN protects the path between your device and the VPN server. After that, the connection is a normal internet connection, so HTTPS still matters.
• If the VPN disconnects without you noticing, your traffic may fall back to the open network. Check that the VPN shows as connected before sensitive tasks.
• Hotel or airport portals sometimes block VPN connections until you log in. Complete the login page first, then connect.
• Public computers, such as in a library or business centre, are a different problem. A VPN on your own device cannot make a shared computer safe.

Summary

Public Wi-Fi is usable if you treat it as a network you do not control. The main risks are fake hotspots, phishing pages and unencrypted traffic, rather than movie-style hacking. Confirm the network name, prefer mobile data for sensitive tasks, rely on HTTPS, use two-factor authentication, and keep software updated. A VPN adds a strong layer of encryption on top of these habits, but does not replace them.

If you often work from cafes and airports, a prepaid XPASS pass can cover a fixed stretch of travel without automatic renewal.