You open your laptop at an airport and see several free Wi-Fi networks. One looks official. Another has a stronger signal. You need to check email, send a document, and perhaps pay a bill. Is connecting a reasonable decision—or an unnecessary gamble?
Public Wi-Fi is not automatically dangerous, and joining it does not automatically expose your passwords. Modern encryption has changed the equation. The Federal Trade Commission says public Wi-Fi is usually safe because most websites encrypt the information traveling between your device and their servers.
But encryption does not make a fake network legitimate or a fraudulent website trustworthy. The practical question is not simply whether public Wi-Fi is safe. It is what you are doing, what protections are working, and what consequences a mistake could have.
What Can Other People See on Public Wi-Fi?
When you connect to a legitimate website using HTTPS, your browser encrypts the information exchanged with that site. An ordinary observer on the local network cannot read your passwords, messages, submitted forms, or the specific page paths inside that protected connection. This protection works even when you do not trust the Wi-Fi network, as the Electronic Frontier Foundation explains in its encryption guidance.
For example, someone sharing the café’s network cannot simply read your banking password from a correctly secured HTTPS connection. The old warning that everyone nearby can see everything you do online is misleading.
However, different observers have different visibility:
- The network operator can observe connection timing, traffic volume, destination IP addresses, and often the domains you contact. Domain visibility depends on protections beyond HTTPS.
- Other hotspot users do not automatically have the operator’s visibility, but poorly configured networks and exposed device services can create opportunities for interference.
- The website itself receives the information you submit. HTTPS does not prevent that website from tracking you or misusing your data.
An encrypted connection protects information in transit. It does not prove the destination deserves your trust.
The Public Wi-Fi Risks That Still Matter
Fake networks and misleading sign-in pages
Attackers can create hotspots that resemble a hotel, airport, or coffee shop’s network. Confirm the exact network name with staff rather than choosing the most plausible option. That reduces mistakes, but names can be copied; it is not proof of ownership. The Australian Cyber Security Centre recommends verifying public networks and limiting automatic connections.
A Wi-Fi password is not a guarantee either. It controls access, but does not establish who operates the network. Likewise, a welcome screen asking you to accept terms or enter a room number is an access mechanism—not evidence that everything afterward is safe.
Stop if a hotspot unexpectedly asks you to install software, a certificate, or a device-management profile. Apple warns that malicious downloads can include configuration profiles that affect device settings. Independently verify unusual requirements before proceeding.
Phishing, HTTP, and ignored security warnings
A fake banking page can use HTTPS. Open sensitive services through a trusted bookmark or official app, and check the actual domain before entering credentials. A familiar logo proves nothing.
Do not submit sensitive information through an unencrypted HTTP page. If your browser displays a certificate or connection-security warning, stop rather than clicking through. A captive portal may complicate connecting, but that is not a reason to bypass a warning on your bank or email site.
Unnecessary device exposure
File sharing, network discovery, and outdated software create risks that HTTPS cannot fix. Keep your operating system, browser, and apps updated. Disable unnecessary sharing and keep your firewall enabled.
Do You Need a VPN on Public Wi-Fi?
Not for every routine browsing session. Widespread HTTPS has made VPNs less necessary for ordinary public Wi-Fi use, according to the EFF’s VPN guidance.
A properly configured VPN encrypts traffic carried through its tunnel between your device and the VPN server. This reduces what the local network can observe and protects tunneled traffic over that portion of its journey. Beyond the VPN server, HTTPS still matters.
A VPN is particularly useful when your employer requires one, you need access to company resources, or you want additional privacy from the hotspot operator. But understand the tradeoffs:
- You shift trust. The VPN provider may gain visibility that the local network loses. Review its ownership, privacy practices, and permissions.
- Coverage varies. A browser-only service or split-tunnel configuration may leave some traffic outside the VPN.
- Performance can suffer. Routing traffic through another server can add latency, and some networks restrict VPN connections.
- It is not anonymity or fraud protection. Websites can identify you when you sign in, and a VPN cannot make a phishing page safe.
For work, use the organization’s approved connection method. For personal use, buy a VPN to solve a specific privacy problem—not because every coffee-shop visit requires a subscription.
When Is a Mobile Hotspot the Better Choice?
Your own cellular connection or password-protected mobile hotspot is a sensible conservative choice when the network is uncertain or the work is sensitive. It removes the venue’s Wi-Fi infrastructure from your connection, though it does not eliminate phishing, device compromise, or carrier visibility.
The NSA recommends personal or corporate hotspots instead of public Wi-Fi in guidance aimed at national-security and defense-sector teleworkers. That does not contradict the FTC’s consumer advice: the audiences and consequences of compromise differ.
Reading the news on HTTPS is different from administering company systems or transferring confidential client records. For banking, HTTPS protects a correctly secured connection, but switching to cellular is a reasonable extra precaution if you cannot confidently identify the hotspot.
Hotspots consume battery and mobile data, and tethering limits depend on your plan. Use a strong hotspot password, turn it off afterward, and remember that cellular access does not cancel workplace VPN requirements.
Settings Worth Checking Before Your Next Trip
- Chrome: Open Settings → Privacy and security → Security → Always use secure connections. This HTTPS-first setting upgrades connections and can warn before loading sites without HTTPS.
- Windows 11: Under Settings → Network & internet → Wi-Fi, open the connected network’s properties and select the Public network profile. “Public” is the protective choice: “Private” enables discovery and sharing intended for trusted networks. Keep the firewall on.
- iPhone and iPad: Under Settings → Wi-Fi, tap the information button beside the network and review Private Wi-Fi Address. Keep it enabled on compatible networks to reduce tracking through your device’s Wi-Fi hardware address. It does not replace HTTPS.
- All devices: Review automatic joining and forget public networks you no longer need. Setting names can vary by software version.
Also remember that Incognito mode is not network privacy. It limits what Chrome retains locally after your session; it does not hide your activity from websites or the organizations operating your connection.
Your Public Wi-Fi Checklist
Before connecting
- Update your device, browser, and apps.
- Use unique passwords and enable multifactor authentication.
- Confirm the network name with the venue.
- Decide whether the task calls for cellular access or an approved VPN.
While connected
- Check website domains and use HTTPS.
- Do not bypass certificate warnings or install unfamiliar software or profiles.
- Keep the firewall enabled and unnecessary sharing disabled.
- Follow workplace rules for sensitive information and remote access.
When finished
- Disconnect and forget networks you do not expect to use again.
- Turn off your personal hotspot if you used one.
What to Do If Something Seems Wrong
Disconnect from the suspicious hotspot and forget it. An unfamiliar network or warning is a reason for caution—not proof that an account was stolen.
If you entered credentials on a suspected phishing page, use a trusted device and connection to change the password, sign out other sessions, enable multifactor authentication, and check recovery details. For email, review forwarding rules too. Follow the FTC’s account-recovery guidance if access has been lost.
If you installed suspicious software or a profile, seek appropriate device-security assistance. For a work-managed device, contact IT promptly rather than improvising changes.
The Bottom Line: Match Protection to the Stakes
Public Wi-Fi is neither automatically unsafe nor worthy of blind trust. HTTPS makes routine use substantially safer, while fake networks, phishing, exposed devices, and sensitive work still require judgment.
Before your next connection, check your settings, verify the network, and choose the connection method that fits the task. Respect security warnings, follow workplace requirements, and switch to cellular when uncertainty or consequences justify it. Those habits matter more than fear—or any single security product.