Is public WiFi still dangerous?

Less than the standard warning suggests and not harmlessly safe. Nearly all web traffic is now encrypted with TLS, and browsers refuse or warn on plaintext, so passive sniffing yields metadata rather than content. What remains are the active attacks: an access point that impersonates a legitimate one, DNS manipulation, captive portals that ask for things they should not, and the exposure of your own device's services to strangers on the same segment.

Do I need a VPN on public WiFi?

It is useful and it is not the thing the advertising claims. A VPN encrypts everything between your device and the VPN server, which prevents the local network from seeing your destinations, from manipulating your DNS, and from interfering with unencrypted traffic. It does not protect the sites you visit from seeing you, does not stop phishing, and hands your traffic to the VPN provider instead of the cafe. Choose a provider you would rather trust than the network.

What is an evil twin attack?

An access point broadcasting the same network name as a legitimate one, so devices connect to it believing it is the real thing. The attacker then sees all traffic, controls DNS, and can serve a fake captive portal. It is cheap to set up and effective because a network name is not authentication, and because devices are configured to reconnect automatically to names they have joined before.

Can someone steal my passwords over public WiFi?

Not by listening to encrypted traffic. They can if you type a password into a fake login page they served you, if they persuade you to install a certificate that lets them decrypt, or if your device connects to a service that still uses plaintext. The realistic password risk on public WiFi is a convincing captive portal or phishing page rather than interception.

What about public phone charging ports?

The theoretical risk is a port that carries data as well as power. Documented cases in the wild remain extremely rare, and phones require explicit approval before trusting a connected computer. That prompt turned out to be defeatable: the ChoiceJacking research presented at USENIX Security 2025 showed a malicious charger spoofing its own input events, over a fake USB or Bluetooth keyboard, to approve the dialog on both Android and iOS in around 133 milliseconds. Apple and Google closed it in iOS and iPadOS 18.4 and in Android 15 by requiring biometrics or a passcode before USB data is allowed. So the prompt is the real control on a patched phone, and a charge-only cable or a small power bank removes the question on any phone.

Public WiFi Safety: What Actually Puts You at Risk in 2026

Q: Is hotel WiFi worse than airport WiFi?

Both are untrusted, and hotel networks have an extra property worth knowing: guests are often on one flat segment, so your device may be directly reachable by every other room. That makes file sharing settings and the firewall profile more important there than the encryption question.

The standard advice about public WiFi was written for a web that mostly ran without encryption. In October 2010 the Firesheep extension, released by Eric Butler at ToorCon 12, let anyone on the same network watch session cookies go past in plaintext and take over Facebook and Twitter accounts with a click. That was a real and easy attack.

It is largely gone. The overwhelming majority of web traffic is now encrypted with TLS, major sites publish strict transport security so the browser refuses to connect insecurely at all, and DNS can be encrypted too. Sitting on a cafe network with a packet capture running mostly produces a list of domains and a lot of unreadable bytes.

The risks that remain are different in character: active rather than passive, aimed at your device or your attention rather than at your traffic. This guide covers those, and is honest about which precautions still earn their place.

Scope: Evil Twin Attacks Explained owns the rogue access point technique, SSL Stripping Explained owns the downgrade attack, and What Is a VPN owns how VPNs work. This page owns the practical situation.

What changed

HTTPS everywhere. Content, credentials and cookies are encrypted between your browser and the site. A network observer sees the destination, roughly how much data, and when. Google puts HTTPS at 95 to 99% of Chrome navigations depending on the platform, rising above 99% on Android and Mac once local addresses are excluded, and that figure has been flat since about 2020. From Chrome 154 in October 2026 the browser turns on Always Use Secure Connections for everyone, so it asks for confirmation before loading any public site over plaintext (Chrome 147 in April 2026 for Enhanced Safe Browsing users).

Strict transport security. Sites on the preload list cannot be downgraded to plaintext by an attacker, because the browser refuses before any request is made. That closes most of the SSL stripping path for the sites that matter, though it does depend on the site participating.

Encrypted DNS. DNS over HTTPS or TLS hides which domains you look up from the local network. The defaults are weaker than the phrase suggests. Firefox turns DoH on by default only in the US, Canada, Russia and Ukraine. Chrome's automatic mode upgrades the resolver you already have, and only when that resolver appears on Chrome's built-in list of DoH providers; on a cafe network the resolver arrives by DHCP from the cafe, it is not on that list, and lookups stay in plaintext. Naming a resolver explicitly in the browser or the OS is what actually closes this.

Certificate warnings that people cannot easily click past. Interception without an installed certificate produces a full-page warning rather than a small padlock change, and on a preloaded HSTS site there is no click-through offered at all.

So the passive listening threat is much reduced. It is not zero: metadata is informative, some applications still do the wrong thing, and older devices are worse.

What is still real

A rogue access point

Anyone can broadcast a network name. "Airport Free WiFi" or a name matching the cafe proves nothing, and there is no authentication of an open network to the client.

Connect to one the attacker runs and they control your default gateway and your DNS. They can serve a fake captive portal, redirect unencrypted requests, break encrypted DNS so lookups fall back to theirs, and see every destination you visit. They cannot read your HTTPS content without a certificate you trust, which is why the certificate request in the next section matters so much.

Devices make this easier by remembering networks. A phone that has joined an open network with a given name will often rejoin any access point broadcasting that name, without asking, anywhere in the world.

The captive portal

The page that appears when you join, asking you to accept terms or log in. It is a normal opportunity for mischief because you expect a strange page to appear and expect to interact with it.

Watch for three things:

A request to install a certificate or a configuration profile. This is a request for permission to decrypt your traffic. No legitimate public network needs it. Refuse, always.
A login form asking for an account you have elsewhere, your email, a social account, a hotel loyalty login. Credential harvesting dressed as access control.
A prompt to download software to connect.

The portal has one legitimate job, which is to let you through. Anything more is a question worth walking away from.

Device exposure

On a public network your device may be directly reachable by every other device on it, and hotel networks in particular often put every room on one flat segment.

What gets exposed if you have not checked: file and printer sharing, network discovery, remote desktop, media servers, development servers bound to all interfaces, and anything else listening. This is a genuine risk and it is entirely within your control.

Attention attacks

The most likely bad outcome on a public network is still that you are phished on it, or that someone reads your screen over your shoulder on a plane. Neither is a network problem, and both are more probable than a cryptographic one.

Where a VPN fits

A VPN builds an encrypted tunnel from your device to a server elsewhere, and your traffic leaves from there.

It genuinely helps with: hiding your destinations from the local network, preventing DNS manipulation by the access point, protecting the residual traffic that is not encrypted, and defeating the local network's ability to inject or interfere.

It does not: make you anonymous to the sites you visit, stop phishing, protect a compromised device, or remove the need to check that you are on the right site.

And it moves the trust. Your traffic is visible in the same way to the VPN provider that it would be to the cafe. That is usually a good trade on a hostile network and it is a trade rather than a removal of risk. Choose a provider on the basis that you would rather they saw your traffic than a stranger's access point would; Best VPNs covers that choice.

For work, a corporate VPN or a zero trust client is generally the right tool, because it is also the access path to internal resources and its trust is already established.

Tip

Whether your tunnel is doing any of that is checkable from the network you are sitting on. The leak test runs live checks on your current connection: the exit IP the internet actually sees, whether WebRTC is handing out your local candidates, whether IPv6 is escaping the tunnel, and whether your timezone and browser locale still report where you really are. Its DNS check is reported as inconclusive for now, so read that row as unanswered rather than as a pass.

What to actually do

Before you travel:

Turn off automatic joining of open networks, and forget saved open networks you no longer use. This closes the automatic-lure path.
Turn off file and printer sharing, and network discovery.
Turn on the device firewall and make sure new networks default to the public profile.
Turn on encrypted DNS in the browser or at the system level.
Adopt passkeys or a hardware key for the important accounts. If the credential cannot be replayed, a hostile network cannot harvest anything useful. Passkeys Explained covers this.
Set up tethering on your phone and know how to turn it on.

When you join a network:

Prefer the network whose name you confirmed with staff. A posted password helps less than it looks: on WPA2-Personal every client derives its keys from the same passphrase, so anyone else who has that password and captures your four-way handshake can decrypt and inject your traffic. WPA3-Personal (SAE) and Enhanced Open (OWE) give each client its own key, which is the property that matters on a network where the password is written on a chalkboard.
Decline any certificate or profile request without exception.
Do not enter an existing account's credentials into a captive portal.
Check the padlock and read the domain before typing anything, particularly on a network you did not expect to be on.

While using it:

Turn the VPN on if you have one.
Keep sensitive work for a network you trust, or over tethering.
Sign out of sensitive accounts when done, and be aware of who can see your screen.

Afterwards:

Forget the network so your device does not offer to rejoin its name elsewhere.

Tethering, which is usually the answer

Use your phone's mobile hotspot instead of the public network.

Cellular data is encrypted between the phone and the carrier, there is no captive portal, no other guest shares your segment, and nobody can broadcast a fake version of your phone. The weak spot is a forced downgrade to 2G, whose encryption is broken and which cell-site simulators trigger deliberately: Android has an Allow 2G toggle on devices with a recent radio HAL (renamed 2G network protection in Android 16) and iOS blocks 2G in Lockdown Mode. The cost is data allowance, which for email, documents and browsing is small.

For anything sensitive, on any network you did not set up yourself, this is the simplest correct choice, and it makes most of the rest of this guide unnecessary.

The verdict

The old warning is out of date and the new situation is narrower and more specific. Encrypted traffic means passive interception yields little. What is left is a hostile access point controlling your name resolution and routing, a captive portal asking for something it should not have, your own device offering services to strangers, and ordinary phishing.

So: turn off automatic joining, turn off sharing, never install a certificate a network asks for, use passkeys where you can, and tether when it matters. A VPN is a reasonable addition on an untrusted network, understood as moving your trust rather than removing the need for it.