For everyday browsing on an up-to-date phone or laptop, public Wi-Fi is reasonably safe, and far safer than its reputation suggests. The encryption built into nearly every modern website protects most of what you do, even when strangers share the network with you. That is the short answer, and it holds for the coffee shop, the airport, and the hotel lobby.
It is not the whole answer, though. A few specific risks survive, and they are worth understanding because each one is easy to defend against once you know what it looks like. The big three are fake hotspots, session hijacking, and the occasional site or app that still skips encryption.
This guide walks through what an attacker on a shared network can and cannot actually do, the situations that deserve real caution, and the exact settings to change on your phone and computer before your next trip.
What Changed: Encryption Became the Default
A decade or so ago, much of the web traveled in plain text. Anyone on the same network with freely available software could read what you typed, including passwords. That era is where the "never check your bank at a coffee shop" advice came from, and back then it was good advice.
Today, nearly every major website and app uses HTTPS, which encrypts everything that passes between your device and the site. You can check this yourself: look for the padlock icon next to the web address in your browser. The padlock is the visual cue that the connection is encrypted. Some browsers have swapped the padlock for a small settings icon, but clicking the address bar will still tell you whether the connection is secure.
Because of this shift, an attacker sitting three tables away cannot read your password when you sign in to your bank, and cannot see your card number when you buy something on a properly secured site. That one change removed most of the danger that gave public Wi-Fi its bad name.
What Someone on the Same Network Can Still Do
Encryption did not eliminate every risk. On a shared network, a motivated attacker can still do a few things:
- See which sites you visit. HTTPS hides the content of your traffic, but the names of the sites you connect to can still leak. Someone could tell you visited your bank, just not what you did there.
- Run a fake hotspot. Anyone can broadcast a network called "Airport_Free_WiFi" and wait for devices to connect. More on this below.
- Intercept unencrypted connections. The rare page that still loads over plain "http://" is fully readable to anyone nearby.
- Steal session cookies in some cases. This one deserves its own section, because it is the risk most people have never heard of.
- Probe your device directly. If file sharing or other network services are left on, your laptop is more exposed on a shared network than it is at home.
Session Hijacking: The Risk Most People Miss
When you sign in to a website, it hands your browser a session cookie: a small token that proves you are logged in, so you do not have to retype your password on every page. Your browser sends it back with every request, quietly, in the background.
On a shared network, an attacker can in some cases capture that cookie, load it into their own browser, and step straight into your logged-in account. This is called session hijacking, and it is nasty because it skips the password entirely. It can even sidestep two-factor codes, since the site believes your session was already verified.
The good news: HTTPS blocks this on well-built sites, because the cookie travels inside the encrypted connection. Hijacking becomes possible mainly when a site is misconfigured, when an old app sends its cookie over an unencrypted channel, or when you click through a certificate warning you should have heeded.
Your defenses are simple. Turn on your browser's HTTPS-only mode (often labeled "Always use secure connections" in privacy settings). Sign out of banking and email sessions you do not need while on a shared network. And if you ever suspect an account was hijacked, use the "sign out of all sessions" option in that account's security settings, then change the password.
Fake Hotspots: The Evil Twin Problem
An evil twin is a rogue network set up to imitate a real one. The attacker names it something plausible, like the hotel's network with one character changed, or simply the same name with a stronger signal. Your phone cannot tell the difference, and neither can you from the network list alone.
Once you connect, the attacker controls the network itself. HTTPS still protects the content of your traffic, but they can see every site name you visit, serve you a fake login portal, and try to steer you toward unencrypted pages.
Three habits neutralize most of this:
- Verify the network name with staff before connecting. If the sign says one thing and the network list says three similar things, ask.
- Be suspicious of portal pages that ask for more than an email address or room number. No legitimate hotspot needs your email password or card details to grant access.
- Turn off auto-join so your device never reconnects to a spoofed copy of a network it remembers. The steps are in the settings section below.
When Mobile Data Is the Better Choice
Your phone's mobile data connection is encrypted between the handset and the carrier, which makes it a convenient escape hatch. Switch to it, or share it with your laptop as a personal hotspot, whenever any of these come up:
- Your browser shows a certificate warning on a public network. Never click through one there. Close the tab and use mobile data instead.
- A checkout or login page loads without the padlock, over plain "http://".
- You need to do banking or move money on a network you have never used before.
- The venue's Wi-Fi behaves oddly, such as repeatedly logging you out or redirecting you to unfamiliar pages.
This is not about fear. It is about picking the boring, reliable connection for the five minutes that matter.
Settings Worth Changing Before Your Next Trip
Each of these takes about a minute, and together they close off the auto-connect tricks that fake hotspots rely on.
- iPhone: Open Settings, tap Wi-Fi, tap the small "i" next to a public network, and turn off Auto-Join. Leave Private Wi-Fi Address turned on; it makes your device harder to track across networks.
- Android: Open Settings, then Network & internet, then Internet. Tap the gear next to a saved network and turn off auto-connect. Menu names vary a little by manufacturer, but the toggle is there.
- Windows: When you first connect somewhere public, choose the Public network profile so Windows locks down sharing. You can check an existing network under Settings, then Network & internet, then Wi-Fi, then the network's properties. While you are at it, open the Windows Security app and confirm the firewall shows as on under Firewall & network protection.
- Mac: Open System Settings, click Wi-Fi, click Details next to the network, and turn off Auto-Join. Then check System Settings, General, Sharing, and switch off File Sharing and anything else you do not use.
Do You Need a VPN on Public Wi-Fi?
A VPN wraps all of your traffic in an encrypted tunnel to the VPN provider's server. On a shared network, that hides even the site names from anyone nearby, and it makes an evil twin far less useful to whoever runs it.
The honest take: for casual browsing on modern sites, HTTPS already does the heavy lifting, and you can live without one. A VPN earns its keep if you regularly work from cafes and hotels, handle sensitive material for work, or simply want one switch that covers everything, including older apps that might not encrypt properly.
Two cautions. Avoid free VPNs of unknown origin, because the operator can see everything the network owner would have seen, and you have shifted your trust rather than removed it. And when you do use one, confirm it is actually connected with our free IP checker: the location shown should be the VPN server, not the coffee shop.
Where to Start Tonight
You can knock out everything on this list in about fifteen minutes, from your couch, before the next time you travel.
- Turn off auto-join or auto-connect for public networks on your phone and laptop, using the steps above.
- Forget old public networks you no longer use, so your device stops searching for them.
- Turn on HTTPS-only mode in your browser's privacy or security settings.
- On Windows, set public networks to the Public profile and confirm the firewall is on in the Windows Security app.
- Run your address through our free email breach checker and change the password on any account that shows up, since a leaked password is a bigger threat than any coffee shop network.
- Install any pending system updates while you are thinking about it.
- Next time you connect somewhere public, glance for the padlock before you type anything sensitive.
Public Wi-Fi does not deserve blanket fear, and it does not deserve blind trust either. Treat unknown networks with mild suspicion, keep auto-join off, and let encryption handle the rest.
