Is Public WiFi Safe? How to Protect Yourself
On a normal HTTPS site, public Wi-Fi cannot read your password or the page body. It can see the domain names you open, unless you tunnel that traffic. A VPN hides those names from the cafe, hotel, or airport. It does not make banking safer in the way ads claim, and some banks will lock you out for using one.
What's actually at risk on public WiFi
Most websites use HTTPS now, which encrypts the content of your traffic even on public WiFi. But several attack vectors remain:
- Evil twin attacks: A malicious hotspot mimics a legitimate network name (e.g., 'Starbucks WiFi'). Your device auto-connects, and the attacker intercepts all traffic — including HTTPS in a man-in-the-middle setup if they can get you to accept a fake certificate.
- Unencrypted apps: Email apps, chat clients, and older apps sometimes send data unencrypted. Anyone on the same network can read it.
- Network sniffing: On open WiFi, traffic is broadcast to everyone on the network. Unencrypted traffic (HTTP, some UDP protocols) can be captured.
- Session hijacking: Attackers can steal session cookies from unencrypted HTTP connections, letting them impersonate you on websites.
- DNS hijacking: The WiFi network's DNS server can redirect your requests — sending you to phishing sites even when you type the correct URL.
What's NOT actually at risk (on most sites)
With HTTPS (the padlock in your browser), the content of your web traffic is encrypted even on public WiFi. An attacker can see that you're visiting google.com but not what you searched for. Modern browsers refuse to load HTTP sites by default. Most risk comes from non-browser internet connections.
How a VPN protects you on public WiFi
A VPN encrypts all your traffic — including traffic from apps, email clients, game servers, and background services — before it leaves your device. Even on a compromised network, an attacker sees only encrypted data going to a VPN server. DNS queries are routed through the VPN, preventing DNS hijacking.
- Encrypts all traffic, not just browser traffic
- Prevents DNS hijacking by routing queries through VPN servers
- Hides your IP from the network and other connected users
- Kill switch prevents unencrypted traffic if VPN drops
Other practical protections (with or without VPN)
- Check for HTTPS: Only submit sensitive information (passwords, payment details) on HTTPS sites
- Enable firewall: Your device's built-in firewall blocks unsolicited incoming connections
- Disable auto-connect: Turn off automatic connection to open WiFi networks
- Use 2FA: Even if a password is captured, 2FA prevents login
- Avoid sensitive transactions: Don't do banking on public WiFi without a VPN
- Mobile data as alternative: Your cellular data connection is encrypted by the carrier — often safer than public WiFi
Frequently asked questions
Is hotel WiFi safe?
The other guests and the hotel can see the domains you open, not the contents of HTTPS pages. Some hotel login pages will not load until you turn the VPN off, because the captive portal has to see your real connection first. Turn it on after you are online.
Can airports see what I'm doing on their WiFi?
They can see which domains you contact, and that a VPN is running if you use one. With the VPN up, the airport sees a connection to the VPN server, not the list of sites inside it. They still see how much data you move.
Is it safe to do banking on public WiFi?
The bank's own HTTPS already encrypts the login. The leftover issue is the network seeing that you opened the bank, plus evil-twin hotspots and DNS tricks. Use the bank's app on cellular data if you can. A VPN hides the destination from the Wi-Fi, and it can also make the bank treat the login as suspicious.