Free WiFi is everywhere — cafés, airports, hotels, libraries, trains. It is convenient, it saves your mobile data, and most of us connect without a second thought. But every so often you have probably wondered: is this actually safe? Could someone be watching what I do on this network?

It is a fair question, and the honest answer is: public WiFi carries real risks, but they are manageable once you understand them. You do not need to avoid free WiFi entirely — you need to use it wisely. This guide explains, in plain English, what the genuine dangers are, how the attacks actually work, and the simple habits that let you enjoy public WiFi without handing your information to strangers. It is a practical piece of everyday cybersecurity.

Why public WiFi is riskier than your home network

To understand the risk, it helps to know how a public network differs from the one at home. Your home WiFi is private and password-protected, and you control who joins it. A public network is the opposite: it is open to anyone in range, you have no idea who else is connected, and you cannot verify who actually runs it.

That combination is what creates the danger. On an open network, you are sharing space with strangers, some of whom may have bad intentions and the basic tools to act on them. And because you cannot confirm the network is legitimate, you cannot be certain that the “Airport Free WiFi” you joined is really run by the airport. Public WiFi is not inherently evil — most of the time nothing happens — but it removes the protections you take for granted at home, and that is what attackers exploit.

The real risks, explained

Let us look at what can actually go wrong, without the scare tactics. There are a handful of genuine threats worth knowing.

Eavesdropping on unsecured connections. In the past, anyone on the same open network could potentially “listen in” on data sent without encryption, capturing information as it travelled through the air. Today this is much less of a threat than it used to be, because the majority of websites now encrypt your connection automatically — but any site or app that is not properly secured remains a weak point.

Fake hotspots (the “evil twin”). This is one of the most serious tricks. An attacker sets up their own WiFi hotspot with a convincing name — “Coffee Shop Free WiFi” — hoping you connect to it instead of the real one. Once you do, all your traffic flows through their equipment, letting them monitor or manipulate what you do. The network looks completely normal to you.

Man-in-the-middle attacks. Here an attacker secretly positions themselves between you and the websites you visit, relaying your traffic while quietly reading or altering it. You believe you are talking directly to a site; in reality, someone is sitting in the middle. This is a favourite technique of the kind of criminals described in our guide on how hackers steal information.

Malware spreading over the network. On some poorly secured public networks, an infected device can attempt to spread harmful software to others connected to it.

Shoulder surfing. The lowest-tech risk of all, and easy to forget: in a crowded public place, someone can simply watch your screen or your fingers as you type a password.

Notice that most of these come down to two things — someone intercepting your data, or someone tricking you about which network you are really on.

To see how easily the trick works, picture a busy airport. You open your WiFi list and see several options: “Airport_WiFi,” “Free_Airport_WiFi,” and “Airport Guest.” Which one is real? An attacker sitting nearby has created one of those names on their own device, hoping you pick theirs. You connect, a normal-looking login page appears, and everything seems fine — but now your traffic is flowing through a stranger’s equipment. Nothing looked wrong, because nothing appeared wrong. This is exactly why guessing at network names is dangerous, and why the simple act of asking staff for the official name defeats one of the most effective attacks out there.

How website encryption already protects you

Here is the reassuring part. The internet has become far safer on public networks than it was years ago, thanks to widespread encryption. Most websites now use a secure connection — you can see it as the little padlock in your browser’s address bar and an address that begins with “https.” When a connection is encrypted this way, the data travelling between your device and the website is scrambled, so even if someone intercepts it, they see meaningless gibberish rather than your password or messages.

This is your first and most important line of defence, and it works automatically. It is also why the single most useful habit on public WiFi is to check for that padlock before entering anything sensitive. If a site handling your login or payment does not show a secure connection, do not enter your details. The encryption does not make you invincible — fake hotspots and tricks can still cause trouble — but it neutralizes the classic “someone is reading my data” fear for the vast majority of your browsing.

How to use public WiFi securely

You can enjoy free WiFi safely by building a few simple habits. None of them is complicated, and together they close off almost all the risk.

Use a VPN. This is the single best protection. A VPN encrypts all of your internet traffic and routes it through a secure tunnel, so even on a compromised or fake network, an attacker sees only scrambled data. It also hides your activity from whoever runs the network. If you regularly use public WiFi, a reputable VPN is worth having — our guide on when to use a VPN explains exactly how it helps and where.

Stick to encrypted sites. Look for the padlock and “https” before entering any sensitive information, and avoid sites that lack it for anything private.

Avoid high-stakes activities. Try not to do online banking, enter card details, or access very sensitive accounts on public WiFi unless you are using a VPN. Save those tasks for a trusted network or your mobile data.

Verify the network name. Before connecting, confirm the exact official network name with staff. Attackers rely on you guessing and joining a lookalike. When in doubt, ask.

Turn off auto-connect and sharing. Stop your device from automatically joining open networks, and switch off file sharing when you are on public WiFi so other devices cannot reach yours.

Forget the network when you leave. Tell your device to forget public networks after use, so it does not silently reconnect — or connect to an impostor with the same name — later on.

Turn on two-factor authentication. With two-factor authentication enabled, even if a password is somehow captured, an attacker still cannot get into your account without the second code. It is a powerful safety net.

Keep your devices updated. Updates patch the security holes that network-based attacks try to exploit, so staying current is quietly one of your best defences.

When in doubt, use your mobile data

Here is a simple fallback that solves almost everything: if a task is sensitive and you are unsure about a network, switch to your phone’s mobile data instead. A mobile connection is private to you and encrypted by design, making it far safer than any open WiFi for things like banking or payments. Many people keep a simple rule — casual browsing on public WiFi, anything involving money or important accounts on mobile data or a VPN. That one habit removes most of the worry.

It is also worth extending this thinking to your personal information generally. Being mindful of what you do on untrusted networks is part of the broader skill of protecting your personal data — the network is just one more place where a little caution pays off.

What to do if you think something went wrong

If you used a public network for something sensitive and later feel uneasy about it, a few quick steps put you back in control. Change the passwords for any accounts you accessed while connected, and do it from a network you trust, such as your home WiFi or mobile data. Turn on two-factor authentication anywhere you have not already, so a stolen password alone is not enough. Keep an eye on your bank and card statements for a while if you entered payment details, and report anything unfamiliar to your bank promptly. And run a security scan on your device for peace of mind. None of this needs to be panicked — acting calmly and quickly is what limits any potential damage, and most of the time these steps are simply sensible precautions rather than a response to a real breach.

Conclusion

So, is public WiFi safe? The realistic answer is that it is safe enough when you use it thoughtfully, and genuinely risky when you use it carelessly. The dangers are real — fake hotspots, attackers intercepting traffic, snoopers on open networks — but they are also well understood and, for the most part, easy to defend against.

The good news is that the internet already protects you more than it used to. Website encryption, shown by the padlock and “https,” scrambles most of your traffic automatically, defeating the classic eavesdropping threat for the vast majority of your browsing. On top of that, a handful of habits closes nearly every remaining gap: use a VPN, stick to encrypted sites, verify the network’s real name, avoid banking on open WiFi, turn on two-factor authentication, and keep your devices updated. And when something feels sensitive or uncertain, simply switch to your mobile data.

You do not need to fear free WiFi or swear it off. You need to treat it like what it is — a convenient but untrusted space — and carry a few simple precautions with you. Do that, and you get all the convenience of connecting on the go without giving strangers a window into your digital life. For the bigger picture of staying safe online, our guide on what cybersecurity is ties these habits together.