Using public Wi-Fi safely: what the real risks are in 2026

For years the advice was simple: never use public Wi-Fi. Today almost every website and app encrypts its traffic with HTTPS, so the picture is more balanced. Public Wi-Fi is much safer than it used to be, but it still carries real risks, and knowing which ones matter helps you protect yourself without avoiding it completely.

What has improved

When you see the padlock in your browser, the connection between your device and the website is encrypted with TLS. Someone else on the same café network can see that you connected to a site, but not your password, messages or card details. Most phone apps now use the same protection. That removes the classic risk of someone simply "listening in" on open Wi-Fi. The cryptography note explains how this encryption works.

The risks that remain

• Fake hotspots. Anyone can create a network called "Airport_Free_WiFi". If you join it, the attacker controls your connection and can show you fake login pages.
• Fake sign-in pages. Many public networks show a "captive portal" asking you to log in. Attackers copy these to collect email addresses and passwords, or ask you to "sign in with" a social account.
• DNS and redirection tricks. A malicious network can send you to the wrong site when you type a name. HTTPS warnings usually catch this, but only if you don't click past them. See how DNS works.
• Other devices on the network. If your laptop shares files or has open services, other users on the same network may be able to reach it.
• Shoulder surfing. The oldest attack of all: someone simply watching your screen.

A practical checklist

1. Confirm the network name with staff or an official sign. Be suspicious of two networks with almost the same name.
2. Mark it as a public network when your laptop asks. On Windows this turns off file sharing and device discovery.
3. Never click through certificate warnings. On public Wi-Fi, a warning is a reason to disconnect, not an inconvenience.
4. Don't give a captive portal your real passwords. A café never needs your email password. Use a throwaway email if one is required.
5. Keep updates on for your operating system, browser and apps.
6. Use multi-factor authentication on important accounts, so a stolen password alone isn't enough. Read strong passwords and MFA.
7. Turn off auto-join for public networks, so your phone doesn't silently connect to a copycat later.

Do you need a VPN?

A trusted VPN encrypts all your traffic from your device to the VPN provider, including DNS lookups and apps that may not protect themselves properly. On public Wi-Fi this adds a useful layer, and many workplaces require their own VPN for this reason. But a VPN is not magic: it moves trust from the café to the VPN provider, so choose a reputable one, or use your employer's. Our IPsec explained and VPNs and IPsec notes show how VPN tunnels work.

Is your phone's hotspot better?

Usually, yes. Sharing your own mobile data with your laptop means you control the network and nobody else is on it. Give the hotspot a strong password and turn it off when you're finished. For banking, work systems or anything sensitive, it is the simplest safe choice.

For IT staff: protecting people on the move

If you look after a team that travels, don't rely on everyone remembering the rules. Use device firewalls set by policy, an always-on company VPN or a Zero Trust access service, MFA everywhere and disk encryption on laptops. Then give staff a short version of the checklist above. Technology handles most of the risk; people handle the rest.

Tip: the most dangerous moment on public Wi-Fi is when a page asks you to type a password you didn't expect to type. Stop, check the address bar, and if in doubt, switch to your phone's hotspot.