Is public Wi-Fi safe?

Start with what has changed. In 2014 roughly a third of web traffic was encrypted; today more than 95 % of page loads in Chrome are HTTPS, and browsers mark plain HTTP as "not secure". HTTPS means the network between you and the site, including the café's router and anyone sniffing the air, sees only encrypted bytes. Passwords, card numbers and messages pass through public Wi-Fi unreadable, which is why the classic warning ("a hacker can read your email at Starbucks") no longer describes the typical risk. What remains falls into five groups.

• Metadata. The network operator sees which servers you connect to: DNS lookups and the server name in the TLS handshake name the site even when the content is encrypted. A café can tell you spent twenty minutes on a job site; it cannot see which jobs.
• Fake and lookalike networks. Anyone can broadcast a network called "Airport_Free_WiFi". A rogue access point sees everything a real one sees, and it can serve a captive-portal page that asks for an email password "to log in", or redirect an HTTP request to a phishing copy of a site. HTTPS and HSTS stop the redirect on sites you have visited before; the fake login page relies on you.
• Unencrypted traffic. Old apps, some smart-device companions, FTP, email clients with plain IMAP/SMTP and the occasional HTTP site still send readable data. On an open network (no password) that data is readable by anyone in range; on a password-protected WPA2 network it is readable by anyone who knows the password and captured your connection setup, which in a hotel is everyone.
• Your device, not your traffic. On a shared network your laptop is reachable by other devices on it. File sharing, AirDrop set to "Everyone", a media server or a forgotten remote-desktop service becomes an open door; most attacks on public Wi-Fi are automated scans for exactly these.
• Session theft. If a site mixes HTTP and HTTPS or sets cookies without the Secure flag, a cookie can leak and someone can reuse your logged-in session. Rare on major sites now, still possible on small ones.

What is not a realistic risk: someone "hacking your phone" merely because it joined the same network (a modern phone exposes nothing to the network by default), or the network operator reading your messages in an app that uses end-to-end encryption.

1. Confirm the network name before you join. Ask staff for the exact name or read it off the receipt or sign; "FreeWiFi" with no password next to "Cafe-Guest" with one is the pattern of a rogue network. Prefer networks with a password, and prefer WPA3 (shown in your device's network details) where it is offered: it protects each device's traffic even when everyone knows the password. Mobile data remains the safest option for anything financial.
2. Turn on HTTPS-only mode. Chrome: Settings → Privacy and security → Security → Always use secure connections. Firefox: Settings → Privacy & Security → HTTPS-Only Mode. Safari upgrades to HTTPS automatically and warns on failures. With this on, a network that tries to downgrade you to plain HTTP gets a warning page instead of your data.
3. Mark the network as public and switch off sharing. Windows asks "Do you want to allow your PC to be discoverable?" the first time you join: answer no, which selects the Public firewall profile. On macOS keep AirDrop on Contacts Only or No One and file sharing off in System Settings → General → Sharing. On phones, nothing is shared by default; leave it that way.
4. Use a VPN on networks you do not control, and test it. A VPN encrypts everything, including the DNS lookups and the server names that HTTPS leaves visible, and moves trust from the café to the VPN provider. It is the single change that removes the metadata and downgrade risks together. It only helps if it is actually carrying your traffic: the VPN test checks the IP, DNS, WebRTC and IPv6 paths in one run, and what is a VPN explains what it does and does not protect.
5. Keep the device updated and the firewall on. The automated scans that target public networks look for known, patched holes. Operating-system updates, browser updates and an enabled firewall close them; this matters more than any other setting on this list.
6. Use two-factor authentication and a password manager. A stolen password is useless without the second factor, and a password manager will not fill your credentials into a lookalike domain, which defeats the fake captive-portal and phishing-page trick without you having to notice the misspelling.
7. Forget the network when you leave. Devices auto-join networks they know by name, and a rogue access point named like your hotel's network can call your phone over from across the street. Turn off auto-join for public networks (iPhone: Settings → Wi-Fi → ⓘ → Auto-Join; Android: the network's settings) or forget them, and keep Wi-Fi off when you are not using it.

Two more that cost nothing: use encrypted DNS (Android's Private DNS, Windows 11's DNS-over-HTTPS setting, or a resolver profile on iOS) so the network cannot see or tamper with your lookups, and avoid typing anything sensitive into a captive portal beyond what it needs to let you online.

The card below runs the checks that matter on a public network from this browser, against our own test servers. The address websites see is the first line; if you expected a VPN and it shows the café's provider instead, the VPN is not carrying your traffic. The WebRTC line tells you whether your browser exposes a second address outside the VPN, the DNS line shows which resolvers answered for you (the hotel's own resolver can rewrite answers; a public or VPN resolver cannot be tampered with by the hotel), and the IPv6 line shows whether a VPN that tunnels only IPv4 is leaving your IPv6 traffic in the open.

A green result means the network is not seeing more than it should; a warning names the gap and links to the full test with the fix. Run it again whenever you change networks: the result belongs to this connection, not to your account.