Is Public Wi-Fi Safe? The Real Risks Today and How to Stay Protected

Is public Wi-Fi safe to use?

For most everyday use, yes. The US Federal Trade Commission (FTC) says public Wi-Fi used to be risky because most websites did not encrypt data, so attackers on the same network could intercept it; now that most websites use encryption, connecting through a public Wi-Fi network is usually safe ^[1]. Encryption scrambles data between your device and the website so that others on the network cannot read it.

The Electronic Frontier Foundation (EFF), a digital-rights group, reaches the same conclusion: it used to be standard advice to use a VPN on public Wi-Fi in coffee shops or airports, but that is no longer as necessary for everyone because the majority of web traffic is now encrypted with HTTPS ^[2].

To check a connection in a browser, the FTC says to look for a lock symbol or 'https' to the left of the website address, including on mobile browsers ^[1]. Apps are harder to check, but the FTC says most use encryption ^[1].

So what is still risky?

Encryption protects data in transit, not your judgement. The risks that remain are fake networks, information that encryption does not hide, devices that share files or are out of date, and fake websites that use encryption too ^[1][2][3]. The sections below explain each.

What can others see on a public Wi-Fi network?

HTTPS protects the content of communications, not the metadata ^[2]. According to EFF, when you visit HTTPS sites, parties along the path can usually see the domain names, for example wikipedia.org, and when you visit them, as well as the sizes of pages and files you load or send ^[2]. They cannot see the specific pages on those sites, your login name or the messages you send ^[2].

On public Wi-Fi, people within range of the network could choose to listen in and see that same metadata, just as your internet provider could at home ^[2]. EFF's view is that if this is an acceptable risk for you, you should not worry about using public Wi-Fi ^[2].

The network operator may also see your device's hardware address, known as a MAC (Media Access Control) address. Apple explains that a device always using the same Wi-Fi MAC address lets network operators and observers link that address to the device's activity and location over time ^[8]. Apple devices therefore use a different private Wi-Fi address on each network and may rotate it ^[8], and Android 10 and later use a randomised MAC address by default ^[9].

What is an evil twin Wi-Fi attack?

In an evil twin attack, described by the US Cybersecurity and Infrastructure Security Agency (CISA), an attacker gathers information about a public access point and sets up their own system to impersonate it, using a stronger broadcast signal so that unsuspecting users connect to the fake one ^[3]. Because the victim's internet traffic then passes through the attacker's system, the attacker can use specialised tools to read data the victim sends, which may include card numbers, usernames and passwords ^[3].

CISA's advice is to always confirm the name and password of a public hotspot before using it, so you connect to a trusted access point ^[3]. HTTPS still limits what an evil twin can read on properly encrypted sites ^[1][2]. The remaining danger is being steered to a fake site, and the FTC warns that scammers create fake websites and encrypt them to look safe: your data may be encrypted on its way, but it will not be safe from the scammers operating the site ^[1].

Can someone on the same network redirect my traffic?

Yes, in some cases. The 2024 TunnelVision technique (CVE-2024-3661) showed that an attacker on the same local network can use a feature of DHCP, the protocol that hands out network settings, to read, disrupt or possibly modify traffic that was expected to be protected by a VPN ^[7]. The researchers who found it concluded that VPNs were not designed to mitigate attacks on the physical local network ^[10].

Are open networks riskier than password-protected ones?

CISA notes that many public access points are not secured and the traffic they carry is not encrypted, so data sent 'in the clear' can be captured with sniffing tools; it advises using access points with at least WPA2 encryption ^[3]. WPA2 and WPA3 are Wi-Fi security protocols that encrypt traffic between your device and the access point ^[3].

A shared password shown on a cafe wall does not make a network private, because everyone who knows it can join; newer Wi-Fi standards address part of this risk. The Wi-Fi Alliance, the industry body that certifies Wi-Fi products, says WPA3 is mandatory for Wi-Fi CERTIFIED devices and gives WPA3-Personal users increased protection from password guessing ^[4]. It also offers Wi-Fi Enhanced Open, which provides unauthenticated data encryption on open networks, an improvement over traditional open networks with no protection at all, and is designed to interoperate with legacy networks, even those using a captive portal (the sign-in page many hotspots show) ^[4].

Wi-Fi encryption is a useful extra layer, but the websites' own HTTPS encryption is what protects your data all the way to the site ^[1][6].

Can Wi-Fi itself be hacked?

Yes, and the history shows why updates matter. In 2017 researcher Mathy Vanhoef disclosed KRACK (key reinstallation attacks), serious weaknesses in WPA2 that let an attacker within range read information assumed to be safely encrypted and, depending on the configuration, inject data ^[5]. To prevent the attack, users had to update affected products as soon as security updates became available ^[5].

In May 2021 Vanhoef disclosed FragAttacks, a set of vulnerabilities affecting all modern Wi-Fi security protocols, including WPA3, and even the original WEP ^[6]. Three were design flaws in the Wi-Fi standard, but they were hard to abuse because they require user interaction or uncommon settings; several programming mistakes in Wi-Fi products were the bigger concern because some were trivial to exploit ^[6]. Updates were prepared during a 9-month coordinated disclosure supervised by the Wi-Fi Alliance and ICASI ^[6].

Vanhoef noted that when a website uses HSTS, a setting that forces HTTPS, the transmitted data could not be stolen through these flaws, and that recent mobile apps use HTTPS by default ^[6]. In other words, layered encryption is the reason a Wi-Fi flaw does not automatically expose everything.

How do you stay safe on public Wi-Fi?

1. Confirm the network name. Ask staff for the exact hotspot name and password before connecting, to avoid evil twins ^[3].
2. Check for HTTPS. Look for the lock symbol or 'https' before entering anything sensitive ^[1].
3. Turn off file sharing. CISA says an unsecured public network combined with file sharing could let a malicious user reach files you shared by mistake; allow sharing only on recognised home networks ^[3].
4. Keep software updated. Update security software, the operating system and the browser, and turn on automatic updates on your phone ^[1].
5. Use strong passwords and two-factor authentication. The FTC recommends both, so a stolen password alone is not enough ^[1].
6. Leave private Wi-Fi addresses on. Apple recommends keeping private addresses enabled for all networks that support them ^[8].
7. Watch your surroundings. CISA warns that people can simply look over your shoulder while you type ^[3].

Do you need a VPN on public Wi-Fi?

Not necessarily. EFF says a properly configured VPN can protect unencrypted traffic and could hide your metadata from someone listening on the local network, but the VPN provider itself would then see all of it ^[2]. It suggests a VPN may be useful when you must use a public network you do not trust, where you do not know who runs it, and you have a VPN you do trust ^[2].

• Benefit: hides which sites you visit from people on the same Wi-Fi ^[2].
• Cost: shifts that visibility to the VPN company, which may log or sell data if its policy allows ^[2].
• Limit: an out-of-date VPN may not protect you well; EFF cites TunnelVision as an example ^[2], and in tests the VPN kept reporting as connected while traffic leaked ^[10].

Practical snags exist too: the UK National Cyber Security Centre notes that some third-party networks restrict or block IPsec VPN traffic, and that forcing all traffic through a VPN can clash with captive portals on public Wi-Fi ^[11]. Another option, as a general precaution, is mobile data from your own phone when you do not trust a hotspot, because it avoids sharing a local network with strangers.