The honest answer: it depends on what you do
Public Wi-Fi at a coffee shop, airport, or hotel is not automatically dangerous, but it is also not automatically safe. The network itself is usually just an ordinary router shared by strangers, some of whom may be careless, curious, or occasionally malicious. The real question is not "is this network safe?" but "am I doing anything on this network that I would regret a stranger seeing?" A few minutes of preparation answers that question for you every time, without needing to memorize a long list of technical rules.
Key terms
- Public Wi-Fi: a wireless network available to unrelated members of the public, typically with no password or a password shared openly, such as at a café or airport.
- Evil twin: a fake Wi-Fi hotspot set up by an attacker with a name copying a legitimate one, such as "Airport_Free_WiFi," designed to trick devices into connecting to it instead.
- Captive portal: the login or "agree to terms" web page that appears automatically when you join many public networks, before full internet access is granted.
- VPN (virtual private network): a service that encrypts your traffic and routes it through another server, hiding your activity from others on the same local network.
- HTTPS: the encrypted version of a website connection, shown by a padlock icon, that protects data between your browser and that specific site regardless of the network you're using.
What actually goes wrong on public networks
Most public Wi-Fi risk falls into a small number of categories. An evil twin hotspot can intercept traffic from anyone who joins it, sometimes showing a fake captive portal that asks for an email address or password. On a legitimate but unencrypted network, another user with the right tools can potentially see unencrypted traffic passing between your device and the router—though this matters far less than it used to, because most websites now use HTTPS by default. A public computer or shared USB charging port introduces separate risks, such as juice jacking, where a compromised charging cable or port attempts to access data on a connected phone.
None of this means every airport lounge is crawling with attackers. It means the habits below cost you almost nothing and remove the realistic worst cases.
Before you connect: a short checklist
- Confirm the exact network name with staff rather than guessing from a list of similar-looking options; evil twins often use a name one character off from the real one.
- Turn off Wi-Fi auto-join for open networks in your device settings, so your phone does not silently reconnect to a remembered public network later.
- Make sure your operating system and browser are up to date before you travel, since updates often patch the vulnerabilities attackers rely on.
- Avoid networks with generic, unbranded names and no captive portal at all, particularly in places where you'd expect one.
- Have a backup plan, such as your phone's personal hotspot, for anything sensitive like banking or filing taxes.
What a VPN does and does not do
A VPN encrypts your traffic between your device and the VPN provider's server, which hides your browsing from others on the same local Wi-Fi network and from the network operator. This is a genuine, useful protection on an unfamiliar network. It is not a cure-all: a VPN does not stop you from typing your password into a fake login page, does not detect malware, and does not make an untrustworthy VPN provider itself trustworthy. Choosing a VPN means shifting your trust from "the coffee shop network" to "this VPN company," so pick a provider with a clear, published privacy policy and a track record, not the cheapest option in an app store ad. For a deeper walkthrough of how VPNs work and when one is actually worth using, see our guide to VPNs.
After you connect: browsing safely
Once you're online, the single most protective habit is paying attention to HTTPS. Nearly all reputable sites use it automatically today, and your browser will typically warn you before submitting a password on a page that does not. Avoid accessing banking, healthcare, or work systems on a network you don't control unless you have a VPN active or are using the site's official mobile app, which is often built with additional safeguards. Be extra cautious of unexpected login prompts, pop-ups asking you to "verify your session," or a captive portal that asks for more than a name and email—these are common patterns used in phishing attempts that rely on the assumption you're distracted while traveling or in a rush.
It's also worth knowing that connecting to any Wi-Fi network reveals your local network address to that network, though your broader identity on the internet is a separate question covered in our explainer on IP addresses and how to hide them.
When to skip public Wi-Fi entirely
Some tasks are worth waiting for a trusted connection. Skip public Wi-Fi for online banking without a VPN, entering a new password for an important account, filing sensitive paperwork, or accessing work systems that your employer has not explicitly approved for remote use over unmanaged networks. Your phone's personal hotspot, while it still uses cellular data, keeps that traffic within a network only you control.
A five-minute setup you can do once
- Turn off automatic Wi-Fi joining for open or unsecured networks.
- Install a reputable VPN app if you frequently work from public places, and test it once before you need it urgently.
- Enable your device's built-in firewall and confirm file sharing is turned off for public networks.
- Save your carrier's hotspot instructions somewhere accessible for when public Wi-Fi looks suspicious.
- Bookmark the sites you access most for money or work, so you always navigate there directly instead of through a search result or link.
The FTC's guide on public Wi-Fi networks and CISA's tips for securing network connections are both useful official references that hold up well over time, since the underlying advice changes slowly even as specific apps and threats evolve.
▶ Watch: How Wi-Fi and Wireless Networks Actually Work (open on YouTube)
Public Wi-Fi is a tool, not a trap—used with a little awareness of what HTTPS protects, what a VPN adds, and which tasks to save for a trusted connection, it is perfectly reasonable to use every day.
A beginner's verification checklist
Good advice about public wi-fi should be practical, specific, and easy to undo when it is wrong for your situation. Before changing a setting, installing an app, or sharing information, identify the official source. An official source is the organization that runs the service, makes the product, or is responsible for the policy—not a sponsored search result, a social-media reply, or an unknown download mirror. Read the page address carefully and use a bookmark or manually typed address for important accounts.
Keep a small record
Write down the date, the device involved, and the exact setting you changed. Take a screenshot of the old setting if it is safe to do so. This gives you a rollback plan and makes it easier to ask qualified support for help. Do not include passwords, recovery codes, full account numbers, or private addresses in screenshots you share.
When a guide asks you to enter credentials, understand the difference between signing in and giving away a secret. Sign in only on the known service page or its official app. A password, one-time code, recovery code, and security-key approval are secrets: support staff, friends, and legitimate companies should not need you to send them in chat. If someone creates urgency—"act in five minutes," "your account will be deleted," or "keep this secret"—pause and independently verify the claim.
Make changes one at a time
Changing several things at once makes troubleshooting difficult. Use this simple method:
- State the problem in one sentence and note when it happens.
- Choose the least invasive official fix first.
- Change one item, then test the original problem.
- Keep the change only if it helps and does not create a new risk.
- Revert it or seek official support if the result is unclear.
For example, if an app suddenly behaves differently, check its update notes and account-security page before installing a "fix" from a video comment. If a device asks for an update, install it from the device's own settings or the maker's site. An update is a vendor-provided software change that repairs defects or adds features. Updates are especially important when they fix security vulnerabilities—mistakes in software that an attacker could exploit.
Use trustworthy help
Prefer a manufacturer's manual, a government consumer-protection agency, a recognized library, or the platform's help center. Check the publication date because menus and policies change. Independent reviews can be useful for experience and comparisons, but they do not override product documentation or local law. Be skeptical of pages that make guaranteed promises, hide who operates them, or demand payment before explaining the issue.
Protect your accounts and devices
Most everyday online safety begins with a few repeatable habits. Use a password manager to create a unique password for every important account. Turn on multi-factor authentication wherever available. Keep automatic updates enabled for your operating system, browser, apps, and router. Back up important files and periodically confirm you can restore one. A backup is a separate copy that lets you recover from loss, damage, or ransomware; copies kept only on the same device do not protect against device failure.
Treat unexpected links, attachments, QR codes, login prompts, and payment requests as things to verify rather than obey. If a message claims to be from a company, open the official app or call the number on a statement you already have. Never solve an urgent digital problem by installing remote-control software for a stranger.
Know when to stop
Stop and contact official support, a trusted local professional, or the relevant authority when a step could expose private data, money, an account, or someone else's equipment. If you believe fraud or a crime is happening, preserve lawful evidence such as dates, screenshots, and receipts, then report it through the proper channel. Do not retaliate, "hack back," or publish accusations without reliable proof.
The goal is informed, lawful control of your own technology. Small, documented steps are safer and more effective than shortcuts.