Is public Wi-Fi safe?

Why public Wi-Fi is safer than it used to be

Ten years ago, warnings about café Wi-Fi were well founded. Many websites sent pages and even login forms without encryption, so anyone on the same network with the right tools could read them. That changed as the web moved to HTTPS, the encrypted version of the web's protocol (the padlock in your address bar).

Google wrote in October 2025 that, according to its Transparency Report, the share of pages Chrome loads over HTTPS rose from around 30-45% in 2015 to the 95-99% range by around 2020, and has largely plateaued since. Google said Chrome will switch on its Always Use Secure Connections setting by default with Chrome 154 in October 2026, warning before you open public sites that don't use HTTPS.

The US Federal Trade Commission's consumer advice (February 2023) reflects this. It says most websites now encrypt data, so using public Wi-Fi is generally safe, and tells people to look for HTTPS. It adds a warning: encryption protects data on the way to a site, but it won't protect you from scammers who run the site.

What official guidance says

The guidance has softened for ordinary users and stayed strict for people handling sensitive work. That's a reasonable way to think about your own situation.

The risks that remain

• Fake hotspots. Anyone can name a network “Airport Free WiFi”. If you join a hotspot run by someone else, they control your connection. HTTPS still protects the content of secure sites, but they can see which sites you contact and try to send you to fake login pages.
• Which sites you visit. Even with HTTPS, the network operator can usually see the names of the sites you connect to, though not the pages or what you type.
• Apps that don't encrypt. The FTC notes it's hard to tell whether a mobile app encrypts its traffic, though most do.
• Scam and phishing sites. A padlock means the connection is encrypted, not that the site is honest.
• Your device itself. Shared networks may let other devices see yours. Keep file sharing off and your system updated.
• Captive portals. Login pages for hotel and airport Wi-Fi often ask for personal details. Give only what's required.

Does a VPN make public Wi-Fi safe?

A VPN encrypts everything from your device to the VPN server, so the Wi-Fi operator and other users see only encrypted traffic to one address. That covers several of the risks above: the operator can't see which sites you visit, unencrypted apps are protected on the local network, and a fake hotspot sees only the tunnel.

It doesn't stop phishing, scam sites or malware, and it moves trust to the VPN company, which could see the same information the café could. Choose a provider with a record you can check. See no-logs policies explained and are free VPNs safe.

A short checklist for public Wi-Fi

1. Check the network name Ask staff for the exact name and password rather than picking the most likely-looking one.
2. Stick to HTTPS Look for the padlock, and turn on your browser's HTTPS-only or always-secure setting.
3. Turn on your VPN for anything sensitive Following NCSC advice, use a VPN before logging in to work systems or accounts. A phone hotspot on your own mobile data is another option.
4. Use two-factor authentication The FTC recommends it. A stolen password is far less useful to an attacker when a second step is required.
5. Forget the network afterwards Turn off auto-join for public networks so your device doesn't reconnect to a look-alike later.
6. Keep things updated Update your operating system, browser and apps, as the FTC advises.

How to see what the network sees

With the VPN on, open our What is my IP tool and check that it shows the VPN's address rather than the café's. Then run a leak test for DNS and WebRTC. If you travel often, our VPN for travel guide covers hotel networks and countries that restrict VPNs.