You are at the airport, or waiting for a coffee order, and your phone shows a list of free Wi-Fi networks. It is tempting to tap one and connect. Before you do, it helps to know what public Wi-Fi actually is, and is not, putting at risk.
This guide explains the real risks of coffee shop, airport and hotel Wi-Fi, what a VPN does in plain terms, and a short list of safer habits. None of it requires you to be a tech expert. It just takes a few good habits.
Is it safe to use public Wi-Fi?
Public Wi-Fi is usually fine for casual browsing, but it is not the place for anything private like banking or shopping. Most websites today encrypt the information you send, which helps protect you even on an open network, according to the FTC’s guide on public Wi-Fi networks. Encryption is not a perfect shield, though, so it still pays to be careful about what you do while connected.
Plain talk: encryption
Encryption scrambles your information so that only the website you are talking to can read it. You can tell a site is encrypted when the web address starts with “https” instead of just “http,” often shown with a small lock icon in your browser.
Public Wi-Fi becomes riskier in a few specific situations:
- Fake networks. A scammer can set up a hotspot with a name like “Airport_Free_WiFi” or “Hotel_Guest” to trick you into connecting to their equipment instead of the real one. This is sometimes called an “evil twin” network.
- Unencrypted sites. If a website does not use “https,” anything you type on it can potentially be seen by someone else on the same network.
- Automatic connections. Some phones and laptops connect to familiar-sounding network names automatically, without asking you first.
- Shoulder surfing. In a crowded coffee shop or airport lounge, someone nearby can simply look at your screen while you type a password.
What actually happens on an open network
An “open” Wi-Fi network is one with no password, or one where the password is posted on a sign for anyone to use. Because everyone shares the same network, someone else connected to it could, in theory, use free tools to watch unencrypted traffic passing by. This is often called packet sniffing.
The good news is that most everyday browsing, like reading the news or checking sports scores, sends and receives encrypted data already. The higher risk activities are the ones where you are typing something private: a bank password, a credit card number, or your Social Security number.
Safety tip
Never enter your online banking password, a credit card number, or your Social Security number on public Wi-Fi. Wait until you are on your home network or use your phone’s cellular data instead.
What does a VPN actually do?
A VPN, short for virtual private network, wraps your internet traffic in an extra layer of encryption and routes it through a separate server before it reaches the website you are visiting. In plain terms, it is like sending your mail inside a locked box instead of an open envelope.
Plain talk: VPN
A VPN is an app that creates a private, encrypted tunnel for your internet traffic. It hides what you are sending from other people on the same Wi-Fi network, even if that network itself is not secure.
The FTC has published guidance for consumers shopping for a VPN app, noting that a VPN “can help shield personal information sent over a public, open Wi-Fi network.” The FTC recommends a few basic checks before choosing one:
- Research the company behind the app before you install it.
- Check what permissions the app asks for on your phone (a VPN app has no reason to need access to your photos, for example).
- Confirm the app actually encrypts your data, since not every app that calls itself a VPN does this well.
- Look at whether the company shares your information with other businesses.
A VPN is a helpful extra layer, not a magic shield. It will not stop you from being tricked by a scam pop-up or a phishing email. Think of it as one more safety habit alongside the others in this guide, not a replacement for them.
Try this
If you travel often or regularly work from cafes, a reputable VPN app from a well-known company is worth the small monthly cost. If you only use public Wi-Fi occasionally, the habits below may be all you need.
Safer habits for coffee shops, airports and hotels
Before you connect
- Confirm the exact network name with staff. Ask “what is your Wi-Fi called?” rather than guessing from the list on your screen. Scammers count on people picking the closest-sounding name.
- Turn off automatic Wi-Fi connections in your phone’s settings so it does not silently join a network you have not approved.
- Turn on your phone’s screen lock so a lost or stolen device is not an open door to your accounts.
While you are connected
- Avoid online banking, shopping, and anything with a password you care about. Save those for home Wi-Fi or your cellular data.
- Use your phone as a hotspot for sensitive tasks. Most cell phone plans let you use cellular data instead of Wi-Fi. It is generally more private than a shared public network, since only your carrier and the website you are visiting are involved, not a room full of strangers.
- Look for “https” and the lock icon before typing anything into a website.
- Turn on two-factor authentication for your important accounts (email, banking, social media). Even if a password leaked, a second code sent to your phone helps keep the account safe.
When you are done
- Log out of sensitive accounts rather than just closing the browser tab.
- Forget the network on your phone or laptop when you leave, especially at a hotel you will not return to.
Say this
At a hotel or cafe counter: “Can you tell me the exact name of your Wi-Fi network, and does it need a password?”
How to tell if a website is encrypted
You do not need to be technical to check this. It takes a few seconds on any phone or computer.
- Open the web browser (Safari, Chrome, or Edge) and go to the site you want to visit.
- Look at the address bar at the top of the screen.
- Check that the address starts with “https” rather than just “http.” Many browsers also show a small padlock icon next to the address when a site is encrypted.
- If the site starts with plain “http” and asks for a password or payment information, close it and avoid entering anything there, especially on public Wi-Fi.
This one habit, checking for “https” before you type anything private, catches most of the risk that public Wi-Fi adds.
A simple comparison
| Situation | Generally lower risk | Higher risk without precautions |
|---|---|---|
| Reading news or checking weather | Yes | No |
| Browsing a store’s website to look around | Yes | No |
| Logging into online banking | No | Yes |
| Entering a credit card number | No | Yes |
| Checking email with two-factor authentication on | Yes | Lower risk, still be cautious |
What to do if you think you connected to a fake network
If you realize after the fact that a network seemed off, such as it disconnected repeatedly, asked for a password to a personal account right away, or the name did not match what staff told you, treat it like any other possible scam.
Change the password for any account you logged into while connected, starting with email and banking. If you are not sure what to check first, our guide on what to do after clicking a scam link walks through a calm, step by step checklist that also applies here.
If you believe your financial information may have been exposed, it is worth reading about freezing your credit after a scam as an extra safety step. And if you want to formally report what happened, our guide on where to report a scam lists the right agency for the United States, United Kingdom, Australia and Canada.
Our Scam-Stopper Kit (free when you join our email letter) also includes a simple checklist you can keep in your wallet or purse for situations like this one.
Where to go from here
Public Wi-Fi is a normal part of traveling and running errands, and it does not need to be a source of worry. A few habits, confirming the network name, saving banking for cellular data or home Wi-Fi, and considering a VPN if you travel often, cover most of the risk. For more everyday scam prevention like this, our book Scam-Proof walks through these habits in more detail, written for people who want plain, practical answers rather than technical jargon.
