Skip to content

Guides

Using public Wi-Fi safely, in cafés, hotels and at the airport

How dangerous open hotspots really are, which attacks exist and the simple rules that keep you safe while browsing on the go.

Published 9 October 2026, 5 min read

Which IP address am I using on the internet right now?Check it for free with our What Is My IP

Free Wi-Fi is available almost everywhere today. Handy, but you are sharing the network with strangers and don’t know who runs it. The good news first: thanks to the HTTPS encryption that is standard today, public Wi-Fi is much less dangerous than it was a few years ago. Some risks remain, though.

What can happen on public Wi-Fi

Fake hotspots. An attacker sets up a hotspot with a trustworthy name such as “Hotel_Guest” or “Airport_Free_WiFi”. Anyone who connects sends all of their traffic through the attacker’s device.

Snooping on unencrypted connections. Websites without HTTPS and some older apps transmit data in plain text. On the same network, it can be read.

Fake login pages. The page where you accept the terms of use suddenly asks for your Google or Microsoft password, or redirects you to a fake page.

Access to shared folders. If your laptop is set up as if you were on your home network, shared folders or printers are visible to others on the same Wi-Fi.

The most important rules

  1. Look for HTTPS. The padlock and https:// in the address bar show that the connection to the website is encrypted. Never ignore a certificate warning on public Wi-Fi.

  2. Choose the right hotspot. Ask the staff for the exact name of the network. Be suspicious of several similarly named networks.

  3. Mark the network as “public”. Windows asks when you first connect whether the network is private or public. Choose “public”. Your device is then invisible to others and sharing is turned off.

  4. No passwords on the hotspot’s login page. To unlock the Wi-Fi, a click, a room number or a code from the staff is usually enough. Never enter login details for other services there.

  5. Turn off automatic connection. Otherwise your phone will later connect by itself to a fake network with the same name.

  6. Use two-factor login. Even if a password is captured, it won’t be enough to get in. More in Two-factor authentication.

  7. Use mobile data for anything important. On the go, it is best to do online banking or log in to work systems over your mobile data connection or a hotspot from your own phone.

Do I need a VPN?

A VPN encrypts all of your traffic between your device and the VPN server. Others on the same Wi-Fi can then read nothing, not even from apps that encrypt poorly themselves. In addition, the websites you visit don’t see your real IP address, but that of the VPN server.

A VPN is especially worthwhile if you often work in hotels, trains or cafés, if you handle sensitive data at work, or if your employer requires it.

What a VPN cannot do: it doesn’t protect against phishing or malware, and it doesn’t make you anonymous. The VPN provider itself sees your traffic, which is why choosing a trustworthy provider matters.

You can check whether your VPN is working with What is my IP: with the VPN switched on, it should show a different address than without.

In short

For normal browsing on HTTPS sites, public Wi-Fi is usually fine today, as long as you choose the right hotspot and don’t click away warnings. For banking and work logins, use mobile data or a VPN instead.

Keep reading