The short answer

Public Wi-Fi is reasonably safe for everyday browsing of HTTPS websites, which is now the vast majority of the web. Encryption between your browser and the site protects passwords and page content even if the network itself is open.

The risks come from the edges: a fake hotspot pretending to be the café network, apps that still send data without encryption, devices that share files with everyone on the network, and the network operator seeing which sites you visit.

A few habits remove most of the risk.

The main risks

Evil-twin hotspots use a name like “Airport_Free_WiFi” to trick you into connecting, then show fake login pages or try to intercept traffic. On an open network, other users can see unencrypted traffic and may try to reach shared folders or vulnerable devices.

Captive portals, the sign-in pages many hotels use, sometimes ask for more personal data than necessary. The network owner can also log the domains you visit through DNS, and may inject ads into unencrypted pages.

  • Fake hotspots with convincing names.
  • Unencrypted apps or old websites.
  • File sharing and discoverable devices.
  • Network owners logging DNS and visited domains.
  • Over-collecting sign-in pages.

How to protect yourself

Ask staff for the exact network name and password. Prefer networks that require a password and use WPA2 or WPA3. Check for the padlock and the correct address before typing a password, and never ignore a browser certificate warning on public Wi-Fi.

Set the network as Public on Windows, which turns off discovery and sharing, and switch off AirDrop or Nearby Share for everyone. A VPN encrypts all traffic between your device and the VPN server, which protects apps and hides your browsing from the network owner.

For banking or work logins, your phone mobile data or hotspot is usually safer than any public Wi-Fi.

  1. Confirm the network name with staff.
  2. Mark the network as Public and turn off sharing.
  3. Use HTTPS sites and heed certificate warnings.
  4. Turn on a VPN for apps and privacy.
  5. Use mobile data for banking.
  6. Forget the network when you leave.

After you connect: quick checks

Open an IP lookup page to see which network you are on. With a VPN active, the provider shown should be the VPN, not the café or hotel network. Run a WebRTC leak test if privacy matters, since some VPN setups leak on new networks.

If a speed test shows very high ping or packet loss, the hotspot is overloaded; mobile data may be both faster and safer.

What you should see with a VPN on hotel Wi-Fi
Without VPN:  ISP: Example Hotel Networks   Region: Da Nang
With VPN:     ISP: Example VPN Hosting      Region: Singapore

Common questions

Can someone hack my phone through public Wi-Fi? It is rare on an updated device. Keeping the operating system and apps up to date closes the vulnerabilities attackers would need.

Is hotel Wi-Fi with a room password safe? It is better than an open network, but every guest shares the same password, so treat it as public.

Do I need a VPN on public Wi-Fi? Not strictly for HTTPS browsing, but it is the simplest way to protect every app and keep the network owner from seeing your activity.