Introduction
Public Wi-Fi is everywhere: the café, the airport, the hotel lobby, the library. It is also one of the most misunderstood parts of everyday online life. The old advice — never use public Wi-Fi for anything — is out of date. The new advice is not “it is fine now,” either.
What changed is encryption. The US Federal Trade Commission (FTC) explains that hotspots used to be risky because most websites did not encrypt traffic, so someone on the same network could read what you sent. Most websites encrypt now, so the FTC says connecting through a public network is usually safe when you can see a lock or https in the address bar. But the US Cybersecurity and Infrastructure Security Agency (CISA) adds the other half: many public access points are still not secured, and the traffic they carry is not encrypted — and sniffing tools can capture passwords or card numbers sent without encryption.
So the honest answer is: public Wi-Fi is safe enough for some things, not safe enough for others, and the difference is what you do on it. This guide sorts activities by risk, covers the habits that matter, and explains when mobile data or your own hotspot is simply the better choice.
The two real risks, in plain language
The wrong network. Someone can set up a hotspot with a name that copies the real one — “CoffeeShop_WiFi” next to “CoffeeShop WiFi” — and wait for you to join it. CISA describes these imposter hotspots as a real technique, and the FCC advises checking with staff when more than one hotspot looks like it belongs to the business. Once you are on the attacker’s network, they can watch or redirect your traffic.
The wrong page. HTTPS encrypts the connection between you and a website, but it says nothing about who runs the site. The FTC points out that scammers build fake sites and encrypt them too, so your data may reach the site safely but will not be safe from the people running it. The padlock tells you the connection is private, not that the site is honest. Our guide to recognizing fake websites and shopping scams covers how to check a site before you trust it. And remember the low-tech risk CISA lists alongside these: shoulder surfing — someone simply watching your screen. Angle it away from the room when you type a password.
What is safe and what is not: an activity table
The useful question is not “is public Wi-Fi safe?” but “is this activity safe on this network?” Use this table as a rule of thumb.
| Activity | On public Wi-Fi | Better choice |
|---|---|---|
| Reading news, blogs and social feeds | Usually fine, if the site shows https | Public Wi-Fi is fine |
| Watching videos or listening to music | Usually fine | Public Wi-Fi is fine |
| Checking email (reading, not resetting passwords) | OK on https webmail or a modern mail app; avoid opening unexpected attachments | Mobile data if the network looks suspicious |
| Online shopping | Risky — card details are involved; only on a site you have verified, with https on every page | Mobile data or home Wi-Fi |
| Online banking or moving money | Avoid | Mobile data or your own hotspot |
| Logging in to work systems or client data | Avoid unless your employer requires a VPN | Your employer’s VPN, or mobile data |
| Filing taxes or entering a Social Security number | Avoid | Home network or mobile data |
| Downloading software or updates | Avoid — use it only from the official app store or vendor site, never a pop-up | Mobile data or home Wi-Fi |
| Entering any password on a page without https | Never | Switch to mobile data, or wait |
The pattern is simple: reading and streaming are low-stakes; anything that moves money, identity documents or work secrets belongs on a connection you control.
Before you connect: a five-step check
Do these every time you join a network you do not own.
1. Verify the network name with staff
Ask staff for the exact network name instead of picking the first familiar-looking option. Read the name back. If two networks look nearly identical, the wrong one may be the trap. CISA advises confirming the name and the exact login steps so you know the network is legitimate.
2. Prefer a network that asks for a password
A network that never asks for a password is not encrypting your traffic at the Wi-Fi level. CISA’s guidance is to connect to access points that use at least WPA2; the FCC describes WPA3 as the current standard when your device supports it, and WPA2 when the device is older. A password is not proof the network is trustworthy — anyone can run a password-protected fake — but an open network is a weaker starting point.
3. Look for the lock — on every page, not just the first
The FTC says to look for a lock or https to the left of the address, on a computer or a phone, and to check it on every page you visit, not just the sign-in page. If any part of your session is not encrypted, the whole account can be exposed. Do not exchange information with a site that does not start with https, and never sign in on a page without it. The FCC’s advice is the same: if a page asks for a password or card number without https, close it.
4. Watch the captive portal
Many hotspots show a login page before they let you online. That page should ask, at most, for an email address or a room number, or for you to accept terms. Be suspicious if it asks for your bank password, a social-media login, or payment details beyond a normal access charge — and never install a profile, certificate or app just to get online. If a network asks you to download software to connect, walk away.
5. Turn off auto-connect and file sharing
Turn off Wi-Fi auto-join so your phone does not silently connect to any network with a familiar name. Turn off file sharing, AirDrop or Nearby Share set to “everyone,” and Bluetooth discoverability while you are out. When you are done, forget the network so your device does not rejoin it automatically next time you pass by.
Do you need a VPN?
A VPN encrypts traffic between your device and the VPN company, which hides it from the local hotspot. The FCC says that if you use public Wi-Fi hotspots regularly, consider a VPN, and CISA also recommends using one when it is available for public wireless access. It is a useful extra layer if you work from cafés, hotels and airports often.
It is not a magic shield. A VPN will not stop you typing a password into a fake sign-in page, it will not remove malware, and it does not fix a weak password. It also moves your trust from the hotspot to the VPN company, so the provider matters: the FTC’s advice on VPN apps is to research the app, check its permissions, confirm it encrypts, and see whether it shares your data. Free VPN apps are a particular risk — if the service is free, your data is often the product.
For occasional café browsing on encrypted sites, a VPN is optional. For regular work on public networks, it is worth having — alongside, not instead of, the other habits in this guide.
When mobile data is the better choice
CISA’s guidance is plain: a mobile connection is generally more secure than a public wireless network. Use mobile data or your phone’s personal hotspot when you need to check a bank balance, move money, or pay for something; when you are logging in to a work system or opening client files; when you are entering an identity number, tax details or health information; when the Wi-Fi network name cannot be verified or the login page looks wrong; or when you are in a hurry and cannot run through the checks above. A personal hotspot uses your phone’s cellular connection, so it carries the same advantage — but it uses your data allowance, so save it for the sensitive moments rather than streaming video through it.
The habits that matter more than any app
Public Wi-Fi cannot compensate for the basics. These four habits do more for your safety than any single tool:
- Keep everything updated. The FTC says to keep security software, the operating system and the browser updated, and to turn on automatic updates — including on your phone. An old browser or operating system is an open door, on any network.
- Use unique passwords and a password manager. If a password is captured on a network, a unique password limits the damage to one account. Our guide to creating strong passwords and storing them safely explains the setup.
- Turn on two-factor authentication. If a password is captured, a second step means it is not enough on its own. Turn it on for email, financial accounts and any account that can reset other passwords — our guide to enabling two-factor authentication walks through it.
- Log out when you finish. Do not leave a banking or email session open on a shared network. Log out, and forget the network when you leave.
Frequently asked questions
Is public Wi-Fi safe if the site shows a padlock?
Usually, yes, for ordinary browsing — the FTC says a connection to an encrypted site is usually safe. But the padlock only proves the connection is encrypted, not that the site is legitimate. Check the full web address, and keep banking and payments on mobile data.
Is a hotel or airport Wi-Fi safer because it asks for a password?
Not necessarily. A password means the traffic is encrypted at the Wi-Fi level, which helps, but you still do not control who runs the network or who else is on it. Treat any network you do not administer as untrusted, and apply the same rules.
Does a VPN make public Wi-Fi completely safe?
No. A VPN hides your traffic from the local network, but it does not protect against phishing pages, fake websites, malware or a dishonest VPN provider. It is one layer among several, not a replacement for the others.
Should I use public Wi-Fi on my phone or my laptop?
The same rules apply to both. On a phone, prefer the company’s mobile website — where you can check for https in the address bar — over its app when doing anything sensitive on an unsecured network, because the FTC notes you cannot always see the encryption state inside an app. Keep the phone’s operating system and apps updated either way.
What should I do if I think I entered a password on a fake network?
Change that password immediately, from a connection you trust — mobile data or home Wi-Fi. If it was a bank or payment account, check recent transactions. Turn on two-factor authentication if it was not already on. And if the same password was used anywhere else, change it there too.
The bottom line
Public Wi-Fi is not the danger it was a decade ago, because most websites now encrypt your traffic — but it is not your home network either. Confirm the network name with staff, look for https on every page, keep sensitive jobs on mobile data, turn off auto-connect and file sharing, keep your device updated, and use a VPN as an extra layer when you work from public networks regularly. The goal is not to fear the café Wi-Fi; it is to know, before you join it, which things belong on it and which things do not.
