Is public Wi-Fi safe to use?

It's much safer than ten years ago because most sites use HTTPS, but the network operator and other users can still see which sites you connect to, fake hotspots exist, and captive portals can be abused. Use HTTPS, keep devices updated and consider a VPN.

Do I need a VPN on public Wi-Fi?

It isn't strictly required for HTTPS sites, but a VPN hides which sites and apps you use from the network operator, protects any unencrypted app traffic, and keeps your device's IP private.

Is it safe to do online banking on public Wi-Fi?

Banking apps and sites use strong encryption, so the risk is low on a genuine network, but a fake hotspot or phishing page is the real threat. Use your bank's official app, check you're on the right network, or switch to mobile data.

Is Public Wi-Fi Safe? A Practical Checklist for Cafés, Hotels and Airports

Disclosure: Some links go to VPN providers via our /go/ links and may earn us a commission in future, at no cost to you. Disclosure

Last reviewed: 30 October 2026 · By the CloakMyIPAddress Privacy Desk

Short answer: public Wi-Fi is far safer than its reputation, because almost all websites and apps now encrypt traffic with HTTPS/TLS. The remaining risks are fake hotspots (“evil twins”), phishing via login (captive) portals, metadata exposure (the operator sees which sites you connect to), and attacks on unpatched devices on the same network. A short checklist, plus a VPN for regular public-Wi-Fi users, covers almost all of it.

What has changed: HTTPS is everywhere

Ten years ago, many sites sent pages and even passwords unencrypted. Today, the vast majority of page loads in Chrome use HTTPS (Google’s Transparency Report tracks this), browsers warn on insecure forms, and many sites use HSTS so your browser refuses to connect without encryption. On a genuine café network, an eavesdropper can’t read the content of your banking session or email.

That’s why some security agencies have softened their advice. The UK’s National Cyber Security Centre, for example, notes that using public Wi-Fi is generally fine for most browsing if you follow basic precautions, and the US FTC’s consumer guidance makes a similar point about encrypted sites and apps.

The real risks that remain

1. Fake hotspots (“evil twins”)

Anyone can set up a hotspot called “Airport_Free_WiFi” or copy a café’s network name. If you connect, the attacker controls your DNS and can show you fake login pages. HTTPS still protects real sites, but a fake site with a convincing name and its own valid certificate can fool you.

2. Captive-portal phishing

The page that asks you to accept terms or enter a room number is a perfect place to ask for “your email and password” or card details. Legitimate hotel portals don’t need your email password.

3. Metadata

Even with HTTPS, the network operator (and anyone controlling the access point) can see:

Which domains you connect to (through DNS lookups and the TLS “server name” field).
When and how much data you transfer.
Your device’s MAC address (modern phones randomise it per network).

4. Other devices on the same network

On open networks without “client isolation”, other users can try to reach your device directly. A fully updated phone or laptop with the firewall on is a hard target; an old laptop with file sharing turned on is not.

5. Unencrypted apps and old protocols

Some IoT apps, older games and email setups still send data without encryption.

10-step public Wi-Fi checklist

Confirm the network name with staff or signage. Be wary of duplicates with slightly different names.
Prefer mobile data or your phone’s hotspot for anything sensitive. In the EU, roam-like-at-home rules mean many travellers can use their domestic data allowance across member states (fair-use limits apply).
Never enter passwords or card details on a captive portal beyond what’s clearly needed (room number, surname).
Check for the padlock and the right domain before logging in anywhere. Better: use your password manager — it won’t autofill on a lookalike domain.
Keep your OS, browser and apps updated. Most real-world compromises exploit known, already-patched flaws.
Turn on your firewall (Windows Defender Firewall, macOS Firewall in System Settings → Network) and mark the network as Public on Windows.
Turn off file and printer sharing / AirDrop “Everyone” while on public networks.
Use encrypted DNS in your browser (DNS over HTTPS) so the network can’t easily read your lookups. See DNS leak test.
Use a VPN if you regularly work from cafés, hotels or trains. It encrypts everything — including DNS and app traffic — to the VPN server and hides your IP. Look for an independently audited no-logs policy: Proton VPN (free plan available), Mullvad, Surfshark and NordVPN all publish independent assessments. Check it works with our leak tests.
“Forget” the network afterwards so your device doesn’t auto-join an imposter later.

Do you need a VPN on public Wi-Fi?

Situation	VPN needed?	Why
Quick browsing of HTTPS news sites	Optional	Content is encrypted; operator sees domains
Logging in to email/banking via official apps	Recommended, not essential	Apps use TLS; VPN adds protection against DNS tricks
Working remotely with company systems	Yes (company VPN)	Policy and access requirements
Hotel or conference Wi-Fi for days	Recommended	Long exposure, many unknown users
Countries with heavy network monitoring	Yes, if legal	Hides destinations from the network

Hotel, airport and train Wi-Fi specifics

Hotels: networks are often shared by hundreds of guests and run by third-party providers. Use a VPN; avoid “upgrade to premium Wi-Fi” pop-ups asking for card details outside the hotel’s official portal.
Airports: watch for evil-twin networks with names like “Free Airport WiFi”. Check the official airport website for the real name.
Trains: many European rail operators provide Wi-Fi through mobile backhaul; it’s usually captive-portal based. Same rules apply.

What about my IP address on public Wi-Fi?

On public Wi-Fi, websites see the venue’s public IP address, not your home IP — so your location appears as the café or hotel. The venue’s operator sees your device. A VPN replaces the venue IP with the VPN’s. Check your current IP here.

FAQ

Is public Wi-Fi safe? Mostly, thanks to HTTPS, but evil twins, phishing portals and metadata remain risks.

Do I need a VPN? Recommended for regular use; not strictly required for occasional HTTPS browsing.

Is banking on public Wi-Fi safe? Low risk on a genuine network via the official app; mobile data is safer.

Sources

Google Transparency Report – HTTPS encryption on the web: https://transparencyreport.google.com/https/overview
UK NCSC – Using public Wi-Fi / device security guidance: https://www.ncsc.gov.uk/collection/device-security-guidance
US FTC – Using public Wi-Fi networks: https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know
European Commission – Roaming in the EU: https://europa.eu/youreurope/citizens/consumers/internet-telecoms/mobile-roaming-costs/index_en.htm
IETF RFC 8484 – DNS over HTTPS: https://www.rfc-editor.org/rfc/rfc8484