By TechsunNews Desk| 4th November | 9 min read
You’re at the airport. The flight has slipped by two hours, your phone is at 14%, and a network called “Airport Free WiFi” is sitting at the top of the list. You tap it before you’ve really decided to. A page pops up asking for your email and a password, and you type something in without thinking.
So, is public Wi-Fi safe? The honest answer is less dramatic than either camp makes it sound. It is safer than it used to be, and it is still not your home network. The real risks have moved, and a lot of the advice floating around hasn’t moved with them.
What This Article Covers
|
Is public Wi-Fi safe? What the FTC says now
Short version: usually, yes, for ordinary browsing and most apps. The US Federal Trade Commission now says that because most websites encrypt your information, connecting through a public network is usually safe. That is a real change. Back in 2011 the same agency warned that most hotspots didn’t encrypt anything, and that logins and private documents could be up for grabs.
What changed is HTTPS. When a site address starts with https and your browser shows a padlock, what you send to that site is scrambled on the way. Someone sharing the café network can’t simply read your password as it goes past. They may still be able to see which sites you connect to, but not what you type into them. The FTC is a US agency, but nothing here is specific to one country; the same advice applies in Singapore, India or anywhere else.
“Usually” is doing a lot of work in that sentence, though. Two things can still go wrong, and neither is fixed by a padlock.
| Quick Answer
On a genuine network, everyday browsing on encrypted sites is usually fine. The bigger dangers now are fake hotspots and fake websites. Confirm the network name, keep sensitive tasks for mobile data when you can, and turn on two-factor authentication. |
Where the real risk is now
- A fake hotspot with a convincing name. Attackers can set up a network that copies a real one, often called an “evil twin.” In Australia, a man was sentenced to seven years and four months in late 2025 for running fake free Wi-Fi at airports in Perth, Melbourne and Adelaide and on domestic flights. Police said his networks tricked nearby devices into treating them as trusted ones they could join automatically. The case was caught because airline staff noticed a suspicious network. One case isn’t a trend, but it shows the trick is real and that it works on ordinary travellers.
- A fake website that looks secure. This is the one most guides skip. The FTC points out that scammers build fake sites and encrypt them too, so your data may travel safely to the site but won’t be safe from the people running it. The padlock tells you the connection is private. It doesn’t tell you the site is honest. A QR code on a café table that says “scan for Wi-Fi” deserves the same suspicion; our guide to spotting a fake QR code shows what to check.
- Your own settings. A phone that auto-joins any network it recognises is exactly what a fake hotspot needs. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends turning off auto-connect, logging out when you’re done and keeping your software up to date. And a hotspot sign-in page has no reason to ask for your email password or a card number.
Here is how the common risks line up against the common defences, including where a VPN fits.
| The risk | What actually helps | Does a VPN help? | Where it shows up |
|---|---|---|---|
| Someone snooping on the network | HTTPS (the padlock) on the sites and apps you use | Adds a layer | Open café, hotel and airport networks |
| A fake hotspot with a lookalike name | Confirming the exact network name with staff; using mobile data | Partly | Airports, flights, busy cafés |
| A fake website or sign-in page | Checking the address; using a bookmark or password manager | No | Links, QR codes, Wi-Fi login pages |
| A stolen or reused password | Unique passwords plus two-factor authentication | No | Anywhere, not just on Wi-Fi |
| An out-of-date phone or laptop | Installing updates | No | Any network you join |
7 ways to protect yourself on public Wi-Fi
So is public Wi-Fi safe enough once you’ve got these habits? For most people, yes. You don’t need all of them every time, and they are in rough order of how much they help.
- Confirm the exact network name. Ask staff, or check the sign on the wall. CISA says criminals can create a similarly named network and hope you won’t notice which one is real. If two networks look alike, ask which one is theirs.
- Use mobile data for anything sensitive. CISA’s tip card also says your own mobile connection, or your phone’s hotspot, is generally more secure than a public network, and that banking, shopping and work that needs passwords or card details are best kept off public Wi-Fi.
- Turn off auto-join, and forget the network afterwards. This is the habit that would have mattered most in the airport case above. Your phone should connect only when you choose.
- Check the address and the padlock. Look for https before you sign in, and take browser warnings seriously. If you reach a login page by tapping a link, open the site yourself instead.
- Turn on two-factor authentication and use unique passwords. The FTC lists both as basics. If a password does get captured, a second step means it isn’t enough on its own. An authenticator app is generally less exposed to SIM swapping than text codes, and our comparison explains why; a password manager makes unique passwords painless.
- Keep your phone and laptop updated. The FTC advises automatic updates, and CISA says updates close known holes attackers rely on. If your laptop shares files or folders on your home network, switch that off before joining a public one.
- Log out when you’re finished. It takes a few seconds and means a session left open can’t be picked up later.
Do you need a VPN on public Wi-Fi?
Not always, and anyone telling you every traveller needs one is selling something. Is public Wi-Fi safe without a VPN? Usually, yes, for the reasons above. A VPN encrypts the traffic between your device and the VPN company, so the hotspot owner and anyone else on the network can’t read it. That is useful if you regularly work from cafés, hotels and airports, or if you want a layer on top of HTTPS.
It also has limits. A VPN won’t stop you typing a password into a fake sign-in page, and it won’t fix a reused password. You are also moving trust from the hotspot to the VPN company, which can see your traffic instead. The FTC’s own advice on VPN apps is to research the app first, check what permissions it asks for, make sure it actually encrypts your information and see whether it shares your data with third parties. If you decide you want one, our VPN guide compares the options.
If you think you joined the wrong network
Don’t panic, and don’t keep using it to “fix” things. Work through this in order:
- Disconnect and forget the network. Switch to mobile data straight away.
- Change your email password first, from mobile data or a network you trust, then any account you signed in to on that network. If that email password was reused anywhere, change those too.
- Sign out of all devices on the accounts that offer it, and check recent activity for anything you don’t recognise.
- Check whether your details have already leaked. Our guide to checking if your data has been leaked walks through it.
- Watch for odd behaviour afterwards. Our list of phone-hacked warning signs helps you tell a glitch from a real problem. If your number stops working, read our SIM swap guide straight away.
| The Bottom Line
Is public Wi-Fi safe? Mostly, yes, and a lot less scary than it was a decade ago. The danger has shifted from someone reading your traffic to someone tricking you into joining the wrong network or trusting the wrong page. So confirm the network name, turn off auto-join, keep the banking for mobile data, and switch on two-factor authentication. Those four habits do more than any app you can buy. |
Frequently asked questions
Is public Wi-Fi safe for checking email?
Usually, yes, if you’re on the genuine network and your email loads over https. The FTC says it can be hard to tell whether a mobile app encrypts its connection, though most do. If you can’t confirm the network is real, or your email is the key to everything else, use mobile data instead and make sure two-factor authentication is on.
Is airport or hotel Wi-Fi safer than a café’s?
Not automatically. A password on the network doesn’t prove it is the real one, and the Australian case involved airports and in-flight networks. What matters is whether you joined the network the venue actually runs, so confirm the exact name with staff wherever you are.
Does a VPN make public Wi-Fi completely safe?
No. A VPN protects your traffic from the network, which is helpful, but it doesn’t protect you from fake websites, reused passwords or an out-of-date phone. Treat it as one layer, not the whole defence.
| Tell Us
Do you ever do your banking or work logins on airport or café Wi-Fi? And have you turned off auto-join on your phone? Share it in the comments. Real habits teach other readers more than any checklist. |
| Editor’s Observation
The “is public Wi-Fi safe” debate keeps producing the same answer: never touch it. I think “never use public Wi-Fi” has become the security equivalent of “don’t talk to strangers”: well meant, impossible to follow, and not very useful at the moment you actually need it. Most of us will connect anyway, so the useful question is how, not whether. A lot of VPN marketing leans on fear, and that’s the part I’d question. Anamika Dey, editor |
Sources
- FTC Consumer Advice: Are Public Wi-Fi Networks Safe? What You Need To Know
- FTC: FTC Offers Tips on Wise Use of Wi-Fi Networks (February 2011)
- FTC: FTC Provides Tips on Using VPN Apps (February 2018)
- CISA: Best Practices for Using Public Wi-Fi Tip Card (archived publication from the Stop.Think.Connect. campaign)
- SecurityWeek: Australian Man Sentenced to Prison for Wi-Fi Attacks at Airports and on Flights
- Information Age (ACS): IT worker jailed over free Wi-Fi data theft (December 2025)
