Free wifi feels like a gift, but every time you connect you are choosing to trust the network and whoever runs it. The real threats to public wifi security are fewer than the headlines suggest, but they are specific and worth understanding. Here is what can go wrong, what HTTPS already handles for you, and what a few simple habits can prevent.
What can actually go wrong on a public network
The most common risk is same-network snooping on unencrypted traffic. On an open wifi network, anyone nearby can run a simple tool that captures the data packets moving between your device and the router. If a site is still served over plain HTTP, your passwords, messages, and session cookies cross that network in a form anyone on it can read. Many older sites and login pages are still HTTP-only, which is why this remains a live problem rather than a theoretical one.
A second risk is the evil twin network. An attacker sets up a hotspot with a name that looks almost identical to the cafe's real one, such as "CoffeeShop_Free" sitting next to "CoffeeShop". Your device may even join it automatically if the name matches one you have used before. From there, the attacker controls every byte you send.
Then there is the network operator itself. Whoever runs the wifi can see every domain you visit, even when HTTPS is active, because the network must see where your data is being sent. That list of domains can reveal a surprising amount about you. For more on how that works and what can be done about it, our article on DNS privacy goes deeper.
Finally, watch for phishing lookalikes in login pages. Fake captive portals can mirror a venue's real login screen almost perfectly, asking you to "sign in to get online" with a Google or email account. Type your password into the wrong one and it belongs to whoever built the page.
What HTTPS protects and what it does not
Modern HTTPS encrypts the content between your device and the site. On a snooped network, an attacker cannot read your password, your messages, or the body of a page you load over HTTPS. That is real protection, and it now covers most of the web. If you want the details, see what HTTPS and the padlock do.
But HTTPS has limits. It does not hide the domain you are visiting, so the network still knows you went to yourbank.com, just not what you did there. And it protects nothing on sites that still use HTTP, where everything passes by in the clear. HTTPS is a strong shield, but it only covers part of the road.
When it matters most
The stakes are highest when the traffic involves banking, work email, or any password. A stolen session cookie from a banking site, even briefly, can be worse than a leaked password because it bypasses the login entirely. Log into your bank's app on a station network and you are betting your whole account on one layer of encryption. Saving sensitive tasks for your home connection or your phone's own data plan removes that bet.
Practical defenses that actually help
- Only use official networks. Ask the staff for the exact network name, including capital letters and spaces.
- Turn off auto-connect. Devices set to join known networks automatically will happily join a matching evil twin. Disable that in your wifi settings.
- Use your phone's mobile hotspot for sensitive tasks. Your own encrypted connection beats any public network for banking and work email.
- Use a reputable VPN on truly unknown networks. A VPN encrypts the connection from your device to a server you trust, which closes the snooping gap. Our guide on VPN explained covers what it can and cannot do.
- Keep your software updated. Updated browsers and operating systems fix the flaws attackers use to break out of HTTPS protections.
How to check you are on the right network
Before you connect, look at the wifi list and match the name exactly, character for character. If the venue posts its network name on a sign, use that as your source of truth. When the network asks you to sign in, read the captive portal carefully and never enter a password for a service that is not clearly the venue's own. On your phone, check the network details for the padlock symbol that marks a password-protected connection, and prefer those over open ones.
An honest note on risk
Public wifi is not inherently a scam hotbed. Most cafes are just cafes. The realistic danger is narrow: unencrypted traffic and phishing, both of which HTTPS already solves for well-run sites. If you visit only HTTPS sites, avoid lookalike portals, and keep sensitive work for your own connection, you have already removed the practical attacks that matter.
FAQ
Is public wifi safe if the site shows HTTPS? Mostly, yes. HTTPS stops anyone on the same network from reading the content you exchange with that site, which is the main attack on open networks.
Should I use a VPN on public wifi? A VPN is a reasonable extra layer on unfamiliar networks, but it is not a substitute for HTTPS. It adds encryption against snooping, while HTTPS remains the primary protection for the sites you visit.
Can the wifi owner see my passwords? They can see the domains you visit and any traffic on HTTP sites. Passwords sent over HTTPS to a legitimate site are encrypted and out of their reach.
What if I think I joined a fake network? Disconnect immediately, then change the passwords for any accounts you used while connected, ideally from a different connection, and sign out of those sessions on your devices.
Sources and further reading
---Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.