Is Public Wi-Fi Safe? How to Use It Without Worry

You’re at the gate with 40 minutes to kill, your mobile data is crawling, and there’s a network called “Airport_Free_WiFi.” Should you join it?

A decade ago, the honest answer was “be very careful.” Today it’s more nuanced. Most of the web is encrypted now, so a stranger on the same network usually can’t read what you’re doing. But scammers have adapted. Instead of snooping on traffic, they set up fake networks and fake sign-in pages to trick you into handing over your details.

This guide explains what’s actually risky about public Wi-Fi in 2026, how fake hotspots work and the handful of habits that let you use airport, hotel and cafe Wi-Fi without worry.

Is public Wi-Fi safe to use today?

For everyday browsing, mostly yes. The Federal Trade Commission’s consumer guidance says public Wi-Fi is usually safe now because most websites use encryption to protect your information. When you see a lock icon or “https” in your browser’s address bar, the data moving between your device and that site is encrypted, so others on the same network can’t easily read it. Most major apps encrypt their traffic too.

But “mostly safe” isn’t “risk-free.” The FTC also points out that encryption only protects data in transit. If you’re on a fake website that also uses HTTPS, your information goes straight to the scammer. That’s why the biggest public Wi-Fi risks today are about deception, not eavesdropping.

Key takeaway: HTTPS protects what you send to a real website. It can’t protect you from typing your password into a fake one. On public Wi-Fi, be most careful about which network you join and where you enter logins.

The real risks on public Wi-Fi

Here are the threats that still matter, ranked roughly by how likely they are to affect an ordinary traveler or remote worker.

Fake hotspots (“evil twins”)

An evil twin is a rogue Wi-Fi network set up to look like a legitimate one, with the same or a similar name. When you connect, the attacker controls the network and can show you fake sign-in pages.

This isn’t just theoretical. In 2024, the Australian Federal Police charged a man accused of using a portable wireless device to create fake free Wi-Fi networks at airports and on domestic flights. According to the AFP, users were directed to a fake page asking them to sign in with email or social media accounts, and those details were captured. He was later sentenced to prison in 2025.

Malicious captive portals

A captive portal is the sign-in page you see when joining hotel or airport Wi-Fi. Legitimate ones ask you to accept terms or enter a room number. A warning sign is any portal that asks you to log in with your email, Google, Apple or social media password, or asks for payment card details on a network you didn’t expect to pay for.

Unpatched devices

On any shared network, other devices can try to reach yours. Fully updated phones and laptops block most of these attempts, but outdated software with known flaws is an easier target.

Shoulder surfing and unattended devices

Some of the oldest risks are physical: someone reading your screen, or grabbing a laptop left on a table while you order coffee.

Unencrypted apps and sites

Most traffic is now encrypted, but not all of it. Older apps, smart devices and some niche websites may still send data in plain text, which anyone on the network could potentially see.

Public Wi-Fi risks at a glance

Simple habits for airports, hotels and cafes

You don’t need to be a security expert to stay safe. These habits cover most of the risk.

1. Confirm the network name. Ask staff or check signage for the exact name. Be wary of near-duplicates like “Free_Airport_WiFi_2.”
2. Never enter account passwords on a Wi-Fi sign-in page. Accepting terms is normal. Logging in with Google, Facebook or your work email is a red flag.
3. Check for HTTPS before entering anything sensitive. If your browser warns that a connection isn’t secure, stop.
4. Turn off auto-join for public networks. On iPhone and Android, you can tell your phone to forget networks after you use them, so it doesn’t silently reconnect to a lookalike later.
5. Keep software updated. The FTC recommends turning on automatic updates for your operating system, browser and security software.
6. Use multi-factor authentication. Even if a password is stolen, multi-factor authentication or passkeys make it much harder to use.
7. Turn off file sharing and AirDrop “Everyone” mode when you’re on public networks.
8. Use a privacy screen and keep your devices with you.

When to use a VPN or your phone’s hotspot

For banking, work systems or anything sensitive, you have 2 safer options.

Your phone’s hotspot. The NSA’s guidance on securing wireless devices in public settings recommends avoiding public Wi-Fi when possible and using a personal or corporate mobile hotspot with strong authentication and encryption instead. Your cellular connection isn’t shared with strangers, and you control the password.

A VPN. When public Wi-Fi is unavoidable, the NSA recommends a personal or corporate VPN to encrypt your traffic. A VPN creates an encrypted tunnel from your device to the VPN provider, so the local network sees only scrambled data. It doesn’t stop you from typing your password into a fake site, though. Our guide do you need a VPN? explains when a VPN genuinely helps and what to look for. If your employer provides one, use it for work tasks.

The NSA also advises turning off Wi-Fi, Bluetooth and NFC when you’re not using them. It’s a small step that reduces how many ways a device can be reached.

Newer Wi-Fi security that helps

Wi-Fi itself is getting safer. The Wi-Fi Alliance’s Wi-Fi Enhanced Open certification adds encryption to open networks without a password, so even a cafe network with no passcode can protect traffic between your device and the access point. WPA3, now mandatory for Wi-Fi CERTIFIED devices, strengthens password-protected networks.

You won’t always know whether a public network uses these features, so don’t rely on them. But if you run a business that offers guest Wi-Fi, enabling them is worth it. See our guide on how to secure business Wi-Fi.

Where to start: a 5-minute public Wi-Fi checklist

Before your next trip or remote workday, run through this:

• [ ] Update your phone and laptop operating systems and browsers.
• [ ] Turn on multi-factor authentication for email, banking and work accounts.
• [ ] Set your phone to not auto-join open networks.
• [ ] Install your employer’s VPN or a reputable VPN, and test it.
• [ ] Check that your mobile plan includes hotspot data.
• [ ] Turn off AirDrop or Nearby Share for strangers.
• [ ] Save your bank’s and airline’s official apps so you’re not logging in through links.

If you’re traveling internationally, also read how to use your phone abroad to plan your data, and set up a digital ID for TSA before you leave.

If something seems off after using public Wi-Fi, such as unexpected login alerts, change your passwords from a trusted connection and check how to tell if your phone is hacked.

Conclusion

Public Wi-Fi isn’t the danger zone it once was, thanks to near-universal HTTPS. The risks that remain are mostly tricks: fake networks, fake sign-in pages and outdated devices. Confirm the network, never log in through a Wi-Fi portal, keep your software updated and switch to a hotspot or VPN for anything sensitive. Do that, and you can work from the airport lounge or the corner cafe without a second thought.

Sources

• FTC: Are Public Wi-Fi Networks Safe? What You Need To Know — role of encryption, remaining risks and recommended habits
• NSA: Guidance on Securing Wireless Devices in Public Settings — hotspot and VPN recommendations, turning off unused radios
• Australian Federal Police: Man charged over creation of ‘evil twin’ free WiFi networks — real-world evil twin case at airports and on flights
• Australian Federal Police: WA man jailed for using ‘evil twin’ WiFi networks — sentencing in the same case
• Wi-Fi Alliance: Security — Wi-Fi Enhanced Open and WPA3