Is public WiFi safe?

Which hotspots are actually risky

In a protected network, traffic between your device and the router is encrypted at the Wi-Fi layer. In an open network, there’s no such encryption, so nearby users can see metadata, regular DNS lookups, and any plain-text HTTP. Criminals can use that context in social-engineering scams.

Does a hotspot become “safe” just because it asks for a password or personal details? Not necessarily. A login page after you connect (a captive portal) does not mean encryption. To check whether a hotspot is protected, open the network’s settings and look for the Security field:

• WPA3-Personal (SAE) — best option for home/guest networks.

• WPA2-Personal (AES/CCMP) — solid, but lacks WPA3’s upgrades.

• WPA2/WPA3 (Transition) — the router supports both; older devices may fall back to WPA2.

• WPA3 Enhanced Open / OWE — no password, yet the traffic is still encrypted.

• Open — no encryption (an unsecured network).

• TKIP/WEP — outdated and unsafe; avoid.

Who is most exposed on public WiFi

Some people connect to open hotspots more often because of work or lifestyle—and face higher public WiFi security risks:

• Business travelers and remote staff working with sensitive company data in cafés or coworking spaces. A leak can cause real financial damage.

• Travelers using hotel and airport WiFi to check bank accounts or book tickets—prime targets for fraudsters.

• Students and freelancers who spend long hours on free WiFi and may cut corners on security for convenience.

The main public WiFi risks

If you skip the basics, you could face stolen funds, account takeovers, leaked corporate docs, or your device being abused in scams. Here’s how attackers operate.

Fake hotspots (Evil Twin)

Attackers clone a legitimate SSID (e.g., Airport_Free_WiFi → Airport-FreeWiFi) and lure you in. You land on a convincing captive portal—sometimes with “Continue with Google/Apple” buttons—and hand over credentials on a phishing page. Even on a real network, attackers can send deauthentication frames to kick you off and nudge you onto the clone. From there it’s phishing, page swaps, and data capture.

Passive data capture (sniffing)

Open networks without WPA2/WPA3 don’t encrypt the Wi-Fi link. Visible items include metadata, standard DNS queries, HTTP pages, and telemetry from older apps. With sniffing tools, an attacker can collect this info and craft targeted phishing. If a site still uses HTTP, the attacker can read logins and cookies in clear text.

Man-in-the-middle (MITM)

In a MITM scenario, the attacker inserts themselves on-path (for example, via ARP spoofing or a fake hotspot) and funnels traffic through their device. They can read or modify unencrypted traffic (HTTP) and even steer you to a look-alike domain using DNS tampering. Proper HTTPS blocks transparent MITM, and modern browsers warn about bad certificates—but users sometimes click through. HSTS also helps prevent “SSL-stripping.”

Example: you join an open café network and open your webmail. The attacker spoofs DNS so mail.example.com resolves to their phishing site. The page looks familiar, the padlock is there (for their domain), and you enter your password. The attacker collects it.

How to protect yourself on public WiFi

1) Prefer protected networks. In the network details, check Security. Choose WPA2/WPA3 (AES/CCMP). Avoid Open (except Enhanced Open/OWE), WEP, and modes with TKIP.

2) Don’t use old-school HTTP and never ignore certificate warnings. HTTPS encrypts content even on an unsecured network. Note: regular DNS is visible unless you use DoH/DoT or a VPN.

3) Use a VPN. A VPN encrypts all traffic between your device and the VPN server—including DNS inside the tunnel—so local snoops can’t read or tamper with it, even on HTTP sites. Observers can still see that you’re connected to a VPN (and how much data you move), but not what you’re doing. Choose reputable paid services; many “free” VPNs come with strings attached.

4) Disable auto-join for WiFi. This cuts the chance of your device latching onto a fake SSID.

5) Double-check the network name. Spot tiny spelling differences and confirm the official SSID with staff to avoid Evil Twin traps.

6) Turn on two-factor authentication (2FA). Even if a password leaks, 2FA can stop the takeover.

7) Keep sensitive work off open hotspots. Avoid online banking, password entries, and large corporate uploads on public WiFi without protection. Use mobile data—or a VPN plus HTTPS—when it absolutely can’t wait.

FAQ