Why public Wi-Fi is appealing
Free Wi-Fi in cafes, airports, hotels, libraries and trains is convenient. It saves mobile data, helps when signal is poor, and is often the only option abroad without roaming charges. For casual tasks such as reading the news, checking a map or watching a video, it usually works fine.
The issue is not that every public network is dangerous. It is that you do not control it, do not know who runs it, and share it with strangers. Those facts change what is sensible to do on it.
The main risks
Others on the network may be able to observe traffic
On an open network with no password, the connection between your device and the access point may not be encrypted at the Wi-Fi level. That means someone nearby with the right tools might be able to see traffic that is not protected by other means. Networks that need a password help somewhat, but when everyone shares the same password, others on the network may still have more visibility than you would like. Newer security standards reduce this in some cases, but you can rarely tell from the connection screen what a particular venue has set up.
The risk is reduced by the fact that most websites and apps now encrypt their own connections. A site using “https” protects the content of the page and what you type from others on the same Wi-Fi. That makes casual snooping far less useful than it was years ago. It does not hide which sites you visit from the network operator, and not every app uses encryption properly.
Fake or “evil twin” hotspots
An attacker can set up a hotspot with a believable name, such as a cafe’s name with a small change, and wait for devices to join. If you connect, the person running it can see and potentially tamper with whatever traffic is not protected. Devices that automatically rejoin remembered network names can be fooled, which is one reason to turn off automatic joining for open networks.
Fake login or “captive” pages
Many public networks show a page asking you to accept terms or enter an email address. Scammers can imitate these pages to collect details, or to prompt you to download something. A portal that asks for payment card details or a password for another account is a warning sign. Genuine portals typically ask only for acceptance, a room number, or an email.
Warnings that get ignored
If your browser shows a certificate warning or says a connection is not private, it is a signal to stop, not to click through. On a public network, such warnings can indicate that someone is interfering with the connection.
Other devices on the same network
On a poorly configured network, other devices might be able to see yours. This is why sharing settings, such as file sharing, should be off when you are away from home.
The pros, summarised
- Convenient and often free.
- Saves mobile data and works indoors where signal is weak.
- Safe enough for low-stakes activity if you take basic care.
- Can be the only option when travelling.
The cons, summarised
- You cannot verify who runs the network.
- Open networks give less protection at the Wi-Fi level.
- Fake hotspots and portals exist.
- Unencrypted traffic and weak apps are exposed.
- Poor performance in crowded places.
Sensible precautions
- Confirm the network name. Ask staff for the exact name and avoid choosing a similar-looking one.
- Prefer your phone’s hotspot for anything sensitive. Your own mobile connection is generally a better choice than an unknown network for banking or shopping, though check any data limits.
- Look for https. Use sites that show a secure connection, and avoid entering passwords or card numbers on pages that do not.
- Be cautious with sensitive tasks. If you can, delay banking, tax and important account changes until you are on a network you trust.
- Turn off automatic connection to open networks, and delete saved networks you no longer use.
- Turn off file and device sharing, and keep your firewall and system settings in their defaults.
- Keep software updated. Installing software updates at home before travelling closes flaws that attackers could try to use on a shared network.
- Use two-factor authentication. If a password is exposed, a second step can stop the sign-in. It is a sensible habit everywhere, and especially when away from home.
- Log out and “forget” the network afterwards.
- Consider a virtual private network. A VPN encrypts traffic between your device and its server, hiding browsing from the local network. It adds a layer, but does not protect against phishing, malware or poor passwords, and you have to trust the provider.
What not to do
Do not install software, browser add-ons or “certificates” because a Wi-Fi login page tells you to. Avoid unexpected pop-ups that claim your device needs an update to continue. Do not assume a network is safe because it has a familiar name or a password on the wall.
A balanced view
Public Wi-Fi is not something to avoid completely, and it is not something to trust blindly. For everyday browsing on encrypted sites, the practical risk is modest and manageable. The more valuable the activity, the more it is worth waiting for a trusted connection or using your own mobile data. Outcomes depend on the setting and on how the specific network is set up, so a little caution is the sensible default.