Is Public Wi-Fi Safe? Real Risks and How to Stay Protected
Basics4 minInnovialabs editorial team
In short
Thanks to ubiquitous HTTPS, public Wi-Fi is much safer than it used to be, but real risks remain — fake hotspots, phishing on login pages and unencrypted apps; a few basic rules plus a VPN where it matters are enough to work calmly.
The short answer
Public Wi-Fi in a cafe, airport or coworking space is safer today than its reputation suggests. Most websites and apps encrypt traffic with HTTPS/TLS, so someone on the same network cannot simply read your passwords or messages.
The risks have not vanished, though. They have moved: the danger now is less the network itself and more fake hotspots, phishing login pages and devices with exposed services. A few simple rules cover almost every scenario.
Real risks
Evil twin hotspots
An attacker creates a network with the same or a similar name as the venue: Cafe_Free_WiFi next to Cafe_WiFi. Your device may join a familiar name automatically. The attacker then sees which sites you connect to and can serve fake pages.
Captive portal phishing
Many networks show a captive portal, a login page asking for a phone number or acceptance of terms. A fake network can show a page asking you to sign in with Google, email or social media and steal those credentials. A real cafe has no need for your work password.
Unencrypted traffic
HTTPS is nearly everywhere, but not quite:
- old or custom internal systems still on HTTP;
- some mobile apps and devices;
- unencrypted DNS queries reveal which sites you visit.
In those cases data really can be intercepted or altered.
Attacks on the device itself
On a shared network other users can see your device. If your laptop has shared folders, remote access or outdated services exposed, someone may try to connect to them directly.
Myths
| Claim | Reality |
|---|---|
| "Anyone on public Wi-Fi can see my passwords" | With HTTPS the content is encrypted; mostly only the site name is visible |
| "A password-protected network is safe" | If the password is on the wall, everyone knows it, including the attacker |
| "The padlock means the site is trustworthy" | The padlock means encryption, not an honest site owner |
| "A VPN protects against everything" | A VPN does not stop phishing, malware or typing a password into a fake site |
Rules for employees
- Confirm the network name with staff instead of guessing between similar names.
- Turn off auto-join for open networks in device settings.
- Never enter work passwords on a Wi-Fi login page. A phone number or a checkbox is normal; a corporate email sign-in is a reason to disconnect.
- Check the address in the browser before typing a password and heed certificate warnings. If the browser complains about the certificate, stop.
- Mark the network as public (Public in Windows): this turns off device discovery and file sharing.
- Keep the OS firewall on and the system updated.
- 2FA on all work accounts: even if a password is stolen, nobody gets in without the second factor.
- For sensitive tasks when in doubt, use your phone's hotspot — a mobile connection is more trustworthy than unknown Wi-Fi.
When a VPN helps
A VPN encrypts all traffic between your device and the VPN server. It is useful when:
- you work with internal company systems that are reached through the corporate VPN anyway;
- some apps or services lack HTTPS;
- you want to hide the sites you visit from the network owner, including DNS queries;
- company policy requires a VPN outside the office.
A VPN will not help if you type your password into a phishing page, download a malicious file or use a service that is already compromised. It also matters whom you trust with your traffic: a corporate VPN or a reputable provider is better than a random free service that may collect data itself.
Common mistakes
- Signing in with Google or Microsoft on a Wi-Fi login page.
- Clicking past browser certificate warnings.
- Leaving folder sharing on a work laptop.
- Installing a random free VPN and considering the problem solved.