What Is Public WiFi — and Why Is It Risky?
Public WiFi is any wireless network you do not own or control: the free network in a cafe, a hotel lobby, an airport lounge, a shopping mall, a hospital waiting room, or a bus station. It is convenient — it saves your mobile data and works when your signal is weak. But convenience is exactly what makes it risky. On your home network, you control the router, the password, and who connects. On a public network, you control none of that. You are sharing a connection with strangers, and you cannot see what the network itself is doing with your traffic.
Most public WiFi networks are run honestly by the business that offers them. The danger is not the cafe — it is the other people on the same network, and the fake networks that imitate real ones. An attacker sitting in the same cafe with a laptop can watch unprotected traffic, set up a network with the same name as the real one, or show you a fake login page designed to steal your password. None of this requires expensive equipment or rare skill. The good news is that a few simple habits shut down almost all of it.
How Attackers Abuse Public WiFi
Understanding the tricks makes the defenses obvious. These are the four common ones:
- Snooping on an open network: Many public networks have no password at all. On such a network, traffic that is not encrypted can be read by anyone else connected. Websites and apps that use HTTPS encrypt your traffic, but anything sent without encryption — an old website, an app that cuts corners — is visible.
- The evil twin: An attacker creates a WiFi network with the same name as the real one — "CoffeeShop_WiFi" next to the real "CoffeeShop_WiFi". Your phone may connect to the fake one automatically, and everything you do then passes through the attacker's laptop.
- Man-in-the-middle: On a network the attacker controls, they sit between you and the internet, watching what you send and, in the worst case, altering what you receive — for example, replacing a real download link with a malicious one.
- Fake captive portals: Many public networks show a login or terms page before letting you online. Attackers copy that page and ask for more than the network needs: your email password, a social media login, or a payment card "for verification". A real captive portal never asks for your passwords.
None of these attacks can hurt you if you follow the rules below. They all depend on you sending something sensitive over an unprotected connection, or trusting a network you have not verified.
The 10 Rules for Public WiFi
Follow these every time you connect to a network you do not own:
- Prefer your mobile data for anything sensitive. Banking, email, work logins, and shopping are safest on your own mobile data. Use public WiFi for reading news, watching videos, and browsing — not for logging in to important accounts.
- Use a reputable VPN on public WiFi. A VPN encrypts everything leaving your device, so even someone watching the network sees only scrambled data. Turn it on before you connect to the WiFi, not after. Choose a VPN provider you trust, keep it updated, and avoid free VPN apps that fund themselves by selling your browsing data — a free VPN can be worse than no VPN.
- Only use websites and apps with HTTPS. Check for the padlock in the address bar before typing a password or payment details. If a site shows a "not secure" warning on public WiFi, close it and try again on mobile data. Never ignore a certificate warning — it may mean someone is intercepting the connection.
- Do not log in to banking or email on public WiFi. Even with HTTPS and a VPN, the safest choice is to wait until you are on a trusted connection. If you must check something urgent, use your bank's official app on mobile data instead.
- Turn off auto-connect and forget the network afterwards. Phones that auto-join any known network can silently connect to a fake network with a familiar name. Turn off "auto-join" for public networks, and use "Forget this network" when you leave, so your phone does not reconnect to it — or to an imitation of it — next time.
- Turn off file sharing, AirDrop and Nearby Share. Sharing features designed for your home can expose your files to strangers on a public network. On Android, turn off Nearby Share and disable "file sharing" or "network discovery" while you are out. On a laptop, set the network type to "Public", which switches sharing off automatically.
- Keep your device updated. WiFi and browser security fixes arrive through ordinary system updates. An unpatched phone or laptop on a hostile network is an easy target, because attackers reuse known flaws that updates already fixed.
- Use two-factor authentication everywhere it matters. Even if someone did capture a password, a second factor — an authenticator app or a hardware key — stops them logging in. SMS codes are better than nothing, but an authenticator app is stronger, and it works without a signal.
- Never enter passwords on a captive portal. A WiFi login page should ask for nothing more than a room number, a code from a receipt, or a tap on "Connect". If it asks for your email password, a social media login, or card details, close it and ask a member of staff whether the page is genuine.
- Watch for the evil twin: verify the network name. Before connecting, ask staff for the exact network name, and check the spelling carefully. Attackers rely on names that look right at a glance. If you see two networks with almost the same name, connect to neither and ask.
Cafes, Hotels and Airports: Extra Care
Some places deserve extra caution. Hotel WiFi is shared by hundreds of guests and is rarely well maintained — treat it like any public network and use your VPN. Airport WiFi is a favourite hunting ground for attackers because travellers are in a hurry and connect to anything with the airport's name — verify the name with an information desk or an official sign, never with a stranger. In cafes, sit where you can see your screen: "shoulder surfing" — someone simply watching you type a password — is the oldest public WiFi attack of all, and it needs no technology whatsoever.
Charging matters too. A public USB charging port can be tampered with, a risk known as juice jacking. Prefer a wall socket with your own charger, or carry a small power bank. If you must use a USB port, use a charge-only cable or a USB data blocker, which lets power through and blocks data entirely.
What to Do If You Already Used Risky WiFi
If you logged in to an important account on a network you now distrust, do not panic — act in this order:
- Disconnect from the network and forget it so your device does not reconnect automatically.
- Switch to mobile data and change the passwords of any accounts you used on that network, starting with your email — email access lets an attacker reset other accounts.
- Check for unfamiliar sessions and sign out everywhere. Most email, social and banking services show active sessions in their security settings. End any session you do not recognise.
- Turn on two-factor authentication on every account that offers it, if you have not already.
- Watch for unusual activity over the next few days: login alerts, password-reset emails you did not request, or transactions you do not recognise. Report anything suspicious to the service and to your bank immediately.
Changing passwords quickly is what separates a close call from a compromised account. Attackers usually try stolen credentials within hours, so the first hour is the one that counts.
Frequently Asked Questions
Is public WiFi safe if I only browse and do not log in?
Mostly yes. Reading news or watching videos without logging in exposes very little. The risk begins when you type a password, enter payment details, or open sensitive accounts — that is when the rules above matter.
Does a VPN make public WiFi completely safe?
A good VPN removes the biggest risk — someone reading your traffic on the network. It does not protect you from fake login pages, malicious downloads, or a compromised device, so the other rules still apply. Think of a VPN as a seatbelt: essential, but not a reason to drive recklessly.
Is my phone's hotspot safer than public WiFi?
Yes. Your own phone hotspot is a private network you control, with a password only you know. When in doubt, use your mobile data or your own hotspot instead of a public network.
Should I trust a WiFi network that asks for a password?
A password helps — it keeps casual strangers off the network — but it does not make the network safe. Everyone in the cafe knows the password, because it is printed on the wall. Treat a password-protected public network exactly like an open one.
Key Takeaways
- Public WiFi is a shared network you do not control — assume someone else is watching.
- Use mobile data for banking, email and anything sensitive; use public WiFi for light browsing.
- A reputable VPN, HTTPS-only browsing, and two-factor authentication together block the common attacks.
- Turn off auto-connect, forget the network when you leave, and switch off file sharing while you are out.
- Never type passwords into a WiFi login page, and verify the network name with staff before connecting.
- If you used a network you now distrust, disconnect, forget it, and change the passwords you used — starting with email.