Is public Wi-Fi safe? The real risks in cafes, hotels and airports

Encryption on almost every website has taken the sting out of most public Wi-Fi warnings. A few real risks remain, and a handful of settings plus your phone's hotspot deal with nearly all of them.

By the editors of ProtectYour.com Last reviewed October 18, 2026 6 min read

Affiliate disclosure: this guide links to NordVPN and Proton. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money

Key takeaways

Mostly yes, for ordinary browsing. HTTPS encrypts what you send to nearly every website, so other people on the network cannot read it.
The real risks now: fake hotspots with convincing names, sign-in pages that ask for passwords or card details, apps that do not encrypt, and file sharing left on.
Your phone's personal hotspot is usually safer than any public network. Use it when you can.
Turn off auto-join for public networks, forget them afterward, and keep your firewall on.
A VPN makes sense when you regularly have to use networks you do not trust, such as hotel or airport Wi-Fi.

What changed: HTTPS is nearly everywhere

Old advice about public Wi-Fi assumed that anyone on the same network could read your traffic. That used to be true. Today, the vast majority of web traffic uses HTTPS, the padlock in your browser's address bar. With HTTPS, the connection between your browser and the website is encrypted. Someone sharing the coffee shop network can see that you visited your bank's website, but not your password, your balance or what you clicked.

Browsers now warn loudly about sites without HTTPS, and many can be set to refuse unencrypted connections entirely (look for an "HTTPS-only" or "Always use secure connections" setting). Banking and email apps on your phone encrypt their traffic too.

So if you are checking the news or your email on a cafe network, the risk is small. The danger has moved from eavesdropping to deception.

The risks that remain

Public Wi-Fi risks today

Risk	How it works	What stops it
Evil twin hotspot	Someone sets up a network named like the real one ("Airport_Free_WiFi"). Your device may join automatically, and the attacker controls what you see first.	Confirm the network name with staff; turn off auto-join; use your hotspot
Captive portal phishing	The sign-in page asks you to log in with Google or Facebook, or to enter card details, on a fake page.	Never type account passwords into a Wi-Fi sign-in page; be wary of card requests unless you expected to pay
Apps without encryption	Some older or poorly made apps and smart gadgets still send data unencrypted.	Keep apps updated; delete abandoned ones; use a VPN on networks you do not trust
Local network exposure	Other devices on the same network can try to connect to yours, especially if you have file sharing or remote access turned on.	Firewall on; mark the network as public; turn off sharing
Ignoring certificate warnings	An attacker in the middle cannot fake HTTPS without triggering a browser warning, unless you click through it.	If your browser warns that a connection is not private on public Wi-Fi, leave

The sign-in page is the risky moment

Legitimate hotel and airport portals usually ask you to accept terms, enter a room number and last name, or sometimes an email address. A portal that asks for your Google, Microsoft or social media password is a red flag. If it insists, skip the network.

The simplest fix: use your phone's hotspot

Your phone's cellular connection is not shared with strangers, and turning it into a personal hotspot gives your laptop the same protection. If your plan includes hotspot data, this beats almost any public network, and it is often faster.

iPhone: Settings > Personal Hotspot, then turn on Allow Others to Join.
Android: Settings > Network & internet (or Connections) > Hotspot & tethering.

Give the hotspot a strong password, and turn it off when you are done. Watch your data allowance if you stream video or download big files.

Settings to change before you travel

Turn off auto-join for public networks. On iPhone, tap the info button next to a network in Settings > Wi-Fi and turn off Auto-Join. On Android, tap the saved network and turn off Auto-connect. On a Mac or Windows laptop, uncheck "connect automatically" when you join.
Forget networks after you leave. Old saved names such as a common airport or chain-store network are exactly what evil twin hotspots imitate. Remove them from your saved list.
Mark the network as public on Windows. When you join, choose Public network (Windows calls it the network profile type, under Settings > Network & internet > Wi-Fi > the network's properties). Public blocks your PC from being discoverable to other devices.
Keep the firewall on. Windows Firewall is on by default. On a Mac, turn it on under System Settings > Network > Firewall.
Turn off sharing. On a Mac, check System Settings > General > Sharing and turn off file sharing, screen sharing and remote login unless you need them. On iPhone, set AirDrop to Contacts Only (Settings > General > AirDrop) so strangers cannot send you files.
Keep everything updated. Security updates close the flaws that local attacks rely on. See how to keep your devices updated.

Free step: two-factor authentication

If someone does steal a password through a fake portal, two-factor authentication stops them from using it on its own. Turn it on for your email and banking first. Our two-factor authentication guide shows how.

When a VPN is worth using

A VPN encrypts all of your device's traffic to the VPN company's server, so the local network sees only scrambled data going to one place. On public Wi-Fi that covers the gaps HTTPS leaves: unencrypted apps, the names of sites you visit, and some local network attacks. It does not stop you from typing your password into a phishing page, and it shifts trust from the network to the VPN provider, so pick one carefully.

You probably do not need one for the occasional cafe visit if you follow the steps above. It makes more sense if you travel often, work from hotels and airports, or use networks you cannot vet. Our guide on whether you need a VPN covers the other reasons people use them, and best VPN compares the main options, including ones we do not earn from, such as Mullvad.

If you want to try one without paying, Proton VPN's free tier has no data cap, according to the company, with fewer server locations and one device at a time. For heavier travel use, paid services like NordVPN offer more locations and connections on several devices at once.

Turn on the VPN's auto-connect setting for untrusted networks if it has one, so it starts before any app sends data. Some captive portals will not load while a VPN is on; connect, finish the sign-in page, then turn the VPN on.

What you do not need to worry about

Checking email or reading news on a known network. HTTPS handles it.
Someone reading your messages in WhatsApp, iMessage or Signal. They are end-to-end encrypted regardless of the network.
Never banking on public Wi-Fi. Banking apps and sites use HTTPS, so on a legitimate network it is usually fine. Use your hotspot if you want extra margin, and never ignore a certificate warning.

Your home network has its own set of settings worth twenty minutes; see how to protect your home Wi-Fi.

Common questions

Is it safe to use public Wi-Fi for online banking?

Usually, on a legitimate network, because banking sites and apps use HTTPS encryption. The bigger risks are fake hotspots and fake sign-in pages. Using your phone's hotspot or a VPN adds margin, and you should never ignore a browser certificate warning.

Can someone see what I am doing on public Wi-Fi?

They can usually see which websites you connect to, but HTTPS hides what you type and read on them. A VPN hides even the site names from the local network.

Do I need a VPN for public Wi-Fi?

Not for occasional use if you keep auto-join off, avoid suspicious sign-in pages and keep your firewall on. A VPN is worth it if you often rely on hotel, airport or other untrusted networks.

What is an evil twin hotspot?

A fake Wi-Fi network named to look like a real one nearby. Your device may join it automatically. Confirm the official network name with staff and turn off auto-join for public networks.

Your next step

Take the 5-minute self-checkTen questions, a score, and the free fix for each gap. Nothing leaves your browser.

If you want a paid toolAffiliate link

NordVPN

Best for: People who want a polished paid VPN with apps on every device and a large server network.

Not for: Anyone who wants a free VPN, or the most anonymous sign-up possible (Mullvad needs no email).

Visit NordVPN