Public Wi-Fi Safety: What Is Actually Risky (and What Isn’t)

Old advice said “never use public Wi-Fi”. Today almost every website uses HTTPS, which encrypts what you send even on an open network. The risks are real but narrower than they used to be.

What HTTPS protects

When the address bar shows a padlock, someone on the same Wi-Fi can see which site you visit but not what you type or read there. Banking apps and most major apps also encrypt their traffic.

The real risks

• Fake hotspots with names like “Airport_Free_WiFi” set up by an attacker. They can show fake login pages.
• Login (captive) pages that ask for your email password, card details or “verify your phone with OTP” — a common trick.
• Sharing turned on: shared folders or printers visible to everyone on the network.
• Old apps and devices that still send data without encryption.
• Shoulder surfing — someone simply reading your screen.

Simple habits

1. Ask staff for the exact network name.
2. When Windows asks, choose Public network — it turns off discovery and sharing.
3. Never enter passwords, card numbers or OTPs on a Wi-Fi login page.
4. For banking or office VPN work, prefer your phone’s hotspot.
5. Turn off “auto-connect” for networks you only used once.
6. Keep your device updated — most real attacks use old, unpatched software.

See also passwords, passkeys and 2FA.