Public Wi-Fi has a reputation problem, and the reputation is roughly a decade out of date.
For years, the standard advice was near-apocalyptic: assume everything you do is visible, never bank on public networks, treat every café hotspot as hostile. That advice made sense when most web traffic travelled unencrypted and intercepting it was genuinely trivial.
The landscape has changed substantially. Which doesn’t mean public Wi-Fi is safe, it means the actual risks are different from the ones people worry about, and the useful precautions are different too.
What changed: HTTPS everywhere
The single most important development is that the overwhelming majority of web traffic is now encrypted in transit.
When you connect to a site over HTTPS, the connection between your device and that server is encrypted end to end. Someone monitoring the network sees that you are connected to a particular domain and how much data passed; they do not see your password, your messages, your account balance, or the content of pages.
Browsers now warn prominently about unencrypted connections, and many refuse them outright. Most major sites have enforced HTTPS for years.
The practical consequence: the classic scenario of someone sitting in a café reading your banking credentials off the network is no longer straightforwardly possible against properly configured sites.
That’s genuine progress. It does not eliminate the risks.
What’s still genuinely risky
Evil twin networks. Someone sets up a hotspot named something plausible, “Airport_Free_WiFi” or “Starbucks Guest”, and waits for people to connect. Once you’re on their network, they control your DNS, can attempt to redirect you, and can present fraudulent captive portals asking for credentials.
This is the most practical remaining threat, and it’s a social engineering attack as much as a technical one.
Malicious captive portals. The login page that appears when you join a network. A fraudulent one might ask for an email password, a social media login, or payment details. Legitimate portals rarely need any of this.
Downgrade attempts. An attacker attempts to force your connection to an unencrypted version of a site. Modern browsers resist this, and sites using HSTS prevent it entirely, but older or misconfigured sites remain vulnerable.
DNS manipulation. Whoever runs the network controls which server your device asks for address lookups, and can direct you somewhere other than where you intended.
Local network exposure. Other devices on the same network may be able to see yours, depending on your settings and whether the network isolates clients.
Simple observation. Someone physically watching your screen. Genuinely common, entirely low-tech, and frequently overlooked.
Precautions worth taking
Verify the network name with staff. This sounds tedious and takes ten seconds. It’s the single most effective defence against evil twin networks, because no amount of encryption helps if you’ve voluntarily joined an attacker’s hotspot.
Be particularly wary of open networks with names similar to the legitimate one, or several networks with confusingly similar names.
Disable automatic connection to open networks. Your device may otherwise reconnect to any network matching a previously saved name, including an attacker’s network deliberately named to match a common one.
On both Windows and mobile platforms, review saved networks periodically and remove ones you no longer use.
Check for the padlock, and be suspicious of certificate warnings. A certificate error on a major website while on public Wi-Fi is a serious signal. It may be benign, captive portals frequently cause them before you’ve logged in, but on a familiar site after connecting, treat it as a reason to stop.
Never click through a certificate warning to reach a site where you’ll enter credentials.
Use your phone’s hotspot instead. For anything genuinely sensitive, mobile data on your own device is meaningfully safer than any public network. Cellular connections are encrypted, and you control the endpoint.
Given how affordable mobile data has become in most markets, this is frequently the simplest answer.
Turn off file sharing. Windows offers network profiles, always select “Public” rather than “Private” when joining an unfamiliar network. This turns off discovery and sharing automatically.
Keep your device updated. Vulnerabilities in network stacks do occur, and patches address them. An updated device is substantially harder to attack.
Use a screen privacy filter if you regularly work in public. The oldest attack vector remains effective.
The VPN question, honestly
VPN providers market heavily around public Wi-Fi, and the marketing frequently overstates the benefit.
What a VPN actually does: encrypts all your traffic between your device and the VPN provider’s server, preventing the local network from seeing which sites you visit or manipulating your DNS.
What that helps with: hostile networks manipulating DNS, observation of which domains you’re visiting, and unencrypted traffic from any older applications that don’t use HTTPS.
What it doesn’t do: protect you from phishing, malware, malicious browser extensions, or entering credentials on a fraudulent site. A VPN encrypts the pipe; it doesn’t evaluate what you send through it.
The trade-off nobody mentions: using a VPN moves your trust from the café’s network operator to the VPN provider. That’s a good trade if the provider is reputable and doesn’t log. It’s a poor trade if the provider is a free service monetising your browsing data, which several have been caught doing.
My honest position: a VPN is a reasonable additional layer if you use public Wi-Fi frequently and choose a reputable paid provider. It is not essential for occasional use given how much traffic is now encrypted by default. And a free VPN is frequently worse than no VPN.
Things genuinely worth avoiding
Even with precautions, some activities deserve a more careful connection: logging into financial accounts, particularly for transactions rather than balance checks; entering payment card details for purchases; accessing work systems containing sensitive information, unless through your employer’s approved VPN; downloading and installing software, since compromised downloads are a real vector; and any activity where you’d be significantly harmed if the session were compromised.
For all of these, waiting until you’re on a trusted connection, or switching to mobile data, is a small inconvenience with a meaningful benefit.
Captive portal discipline
When a login page appears, a few rules:
Never enter passwords from other services. No legitimate Wi-Fi portal needs your email password. A portal asking for social media credentials is either badly designed or fraudulent.
Be cautious with payment details. Paid Wi-Fi exists in airports and hotels, but verify you’re on the correct network first.
Close the portal after connecting, and don’t leave it open in a background tab.
Be suspicious if the portal appears repeatedly or at unexpected moments.
Two-factor authentication matters more here
If there’s one measure that reduces the consequences of a public Wi-Fi compromise, it’s this.
Even if credentials are somehow captured, an account requiring a second factor remains protected. Authenticator apps are preferable to SMS, since SMS can be intercepted through SIM swapping.
Enable it on email first. Email resets everything else, which makes it the highest-value account to protect.
A realistic summary
Public Wi-Fi in 2026 is considerably safer than its reputation, because encryption is now the default rather than the exception.
The remaining risks are concentrated in a few places: joining a network that isn’t what it claims to be, entering credentials into something fraudulent, and having your device exposed to others on the same network.
Verify the network name. Set the profile to public. Keep your device updated. Enable two-factor authentication. Use mobile data for anything genuinely sensitive. Consider a reputable VPN if you’re on public networks regularly.
That’s a proportionate response, neither the paranoia of a decade ago nor the complacency of assuming encryption handles everything.