What makes shared networks different
Public Wi-Fi in cafes, airports, hotels and libraries differs from your home network in one important way: you do not control it, and you share it with strangers. You cannot know who runs it, how it is configured, or who else is connected. That uncertainty is the source of the risks, but it is easy to overstate them. Much of the older scary advice dates from a time when most websites sent data in the clear, which is much less true today.
Risks that are real
Fake hotspots. Anyone can set up a Wi-Fi network and give it a name that looks like a legitimate one, such as a plausible variant of a cafe’s name. Devices that automatically join familiar network names can sometimes be fooled. Once you are connected through a hotspot someone else controls, they can see the traffic that passes through it and can try to redirect you.
Snooping on unprotected traffic. On an open network with no password, the wireless signal between your device and the access point may not be encrypted. Someone nearby with the right tools could, in principle, observe unencrypted traffic. Passwords on some networks protect the radio link, but everyone who knows the password may still be on the same network.
Unencrypted websites and apps. If a site or app does not use encryption, then the content you send can be read by anyone who can see the traffic. Most major sites use HTTPS now, but not all services and not all older apps do.
Misleading sign-in pages. Many public networks ask you to open a page and accept terms or enter details. A fake version can be used to collect information such as an email address or password, particularly if you reuse the same one elsewhere.
Attacks on your device. On a shared network, other connected devices may be able to reach yours if file sharing or similar services are switched on. Out-of-date software is also easier to exploit.
Risks that are often overstated
“Hackers can read everything you do.” When you visit a site using HTTPS, the connection between your browser and that site is encrypted from end to end, regardless of the network in between. Someone on the same Wi-Fi may be able to see which site addresses you contact, and roughly how much data you exchange, but not the contents of the pages or what you type into them. Browsers warn when a connection is not secure.
“Public Wi-Fi is always dangerous.” For most everyday browsing on modern sites, the added risk is modest. It becomes more significant when the network itself is not what it claims to be, or when software is out of date, or when people are tricked into approving something they should not.
“A password-protected network is safe.” A password on a cafe network that is printed on the receipt tells you very little. Everyone has it, and the network owner can still see your connection details.
“A VPN fixes everything.” A virtual private network encrypts the route between your device and the VPN provider, which can hide your traffic from the local network. It does not make you immune from phishing scams, malware or a website’s own tracking, and it moves your trust from the local network to the VPN provider, so the provider’s practices matter. Whether it is worth using is a judgment call, not a requirement.
Safeguards that help
- Prefer your mobile connection for sensitive tasks. Using mobile data, or tethering from your phone, avoids the shared network entirely. For banking or important account changes, this is often the simplest approach.
- Check for HTTPS. Look for the secure indicator in the address bar and pay attention to browser warnings. Do not click through certificate warnings on public networks.
- Confirm the network name. Ask staff for the exact name rather than guessing, and be cautious about networks with similar names.
- Turn off automatic joining of open networks. This stops your device from silently connecting to any familiar-looking name. It also helps to “forget” networks you no longer use.
- Keep your device updated. Many network-based attacks rely on known flaws that updates close.
- Switch off sharing features. When prompted, mark the network as public so your device limits what it exposes.
- Use two-factor authentication. If a password were captured, a second step often stops the login. A passkey or hardware key is more resistant to fake pages than a typed code.
- Be wary of sign-in pages. Do not enter more than the network needs, and never reuse an important password there.
- Consider a VPN from a reputable provider if you want an extra layer. It can reduce what the local network sees, but it is not a complete answer.
- Avoid sensitive actions when you can. Postponing a bank transfer until you are on a trusted network is a low-cost precaution.
A sensible way to think about it
The risk on public Wi-Fi is usually lower than the headlines suggest and higher than zero. Encryption in browsers and apps does much of the protective work, and the habits above fill in the gaps. Your own home network matters too, and it is worth reading about home Wi-Fi settings and the use of a guest network for visitors and smart devices. If a situation feels unusual, such as an unexpected sign-in prompt or repeated certificate warnings, treat that as a reason to disconnect and use your mobile connection instead.