Cafés, airports, hotels and trains all offer free Wi-Fi, and most of the time nothing goes wrong. Still, a network you do not control is a network you should treat with some care. The good news is that a few habits remove most of the risk. This guide explains what public Wi-Fi can and cannot expose, and what to do instead when you need to get online away from home.
Is public Wi-Fi actually dangerous?
It is less dangerous than it was a decade ago. Most websites and apps now encrypt their traffic with HTTPS, which means the café owner or another customer on the same network cannot simply read your messages or passwords as they pass by. That change removed the biggest worry.
Risk has not disappeared, though. On an open network, the person running it can see which sites you connect to, and a careless or malicious operator can try to redirect you. Some apps and older sites still send data without proper protection. And the network itself may not be what it claims to be.
What are the real risks?
The most common problem is a fake network. Someone sets up a hotspot called “Airport Free WiFi” or “Hotel Guest,” and people connect without checking. Whoever controls that hotspot can watch connection details and try to steer you toward a fake login page.
A second risk is the captive portal, the page that asks you to accept terms or enter an email address. Some are legitimate. Others ask for more than they need, such as a password, a phone number or payment details. A Wi-Fi login page should never need your bank or email password.
A third risk is your own device. Sharing settings, outdated software and apps that trust any network all make a bad connection worse. These are problems you can fix before you leave home.
How do you check that a network is genuine?
Ask staff for the exact network name and, if there is one, the password. Do not pick the strongest or most convenient-looking name from the list. Venues often display the name on a sign or a receipt.
Be wary of near-duplicates, such as two networks with almost the same name. If you cannot confirm which one is real, skip both. Also forget networks you will not use again, so your phone does not reconnect to a look-alike later.
A network with a password is not automatically safe, since everyone in the venue shares it. It is somewhat better than an open one, but you should still follow the habits below.
What should you avoid on public Wi-Fi?
You do not need to give up using the internet. Instead, think about what would hurt most if someone saw it, and save those tasks for a network you trust. Good candidates to postpone are:
Online banking and card payments
Changing passwords or recovering an account
Filling in forms with ID numbers or addresses
Downloading apps or updates from an unfamiliar prompt
Reading the news, checking a map or watching a video carries very little risk. If something urgent comes up, use your phone’s mobile data instead. It is not connected to the venue’s network, and it is usually the simplest fix.
What protects you when you do connect?
Check that sites use HTTPS. Your browser shows a padlock or a clear warning when something is wrong. If you see a certificate warning, stop and do not click through it. Warnings on a public network are worth taking seriously.
Turn on two-factor authentication for your important accounts, ideally with an authenticator app or a passkey instead of text messages. That way, a stolen password alone is not enough to get in. Keep your phone and laptop updated, because many updates fix flaws that attackers use on shared networks.
Switch off automatic connection to open networks, and turn off file sharing, and set AirDrop-style discovery to contacts only while you travel. A VPN can add a layer of protection by encrypting traffic between your device and the VPN provider. It hides your browsing from the venue, but it does not make a fake login page real, and you are trusting the provider instead. Choose one with a clear privacy policy, and treat it as an extra, not a substitute for the habits above.
What if you think you were exposed?
Disconnect from the network and forget it. Then, on a trusted connection, change the passwords for any account you used on it, starting with email, because email controls password resets for everything else. Sign out of other sessions where the service allows it.
Check your recent account activity for logins or changes you do not recognize. If you entered card details, watch your statements and contact your bank if anything looks wrong. Acting quickly limits the damage, and a false alarm costs you only a few minutes.
How do you keep your files safe on the move?
Travel is when documents are most exposed. Photos of a passport, a visa or a card sit in a camera roll, often backed up automatically, and can be seen by anyone who borrows your phone or by an app with broad photo access. A public network adds one more place for things to go wrong.
Consider keeping those files out of your everyday gallery. Revault stores them in an encrypted vault on your device, with no account needed, so they are readable offline and are not sitting in your camera roll. The apps are built to work without a network, which suits a trip where connections are unreliable. You still need to look after your recovery key and your device, but your documents are not dependent on the café’s Wi-Fi.
Whatever tools you use, the approach is the same: share less over networks you do not control, keep sensitive things out of casual view and have a plan for when a connection looks wrong.