Is public Wi-Fi safe to use? What the FTC says

Some links in this guide are affiliate links: if you buy, TechForLive may earn a commission at no extra cost to you. Details.

Is public Wi-Fi safe to use? The short answer

Public Wi-Fi is usually safe for ordinary browsing. The Federal Trade Commission, the US consumer protection agency, says most websites now encrypt the information you send. That encryption scrambles your data between your device and the website, so someone else on the same network cannot read it. Ten years ago that was not true, and public Wi-Fi was genuinely risky. Today the picture has changed, and the answer is mostly yes, with a few exceptions worth knowing.

The exceptions matter. Encryption protects the trip between you and the website, not the website itself. A fake login page can still steal your password, and a dishonest site is still dishonest. The network can also be fake: anyone can set up a hotspot called CoffeeShop_WiFi and wait for people to join. And some older sites and apps still send data without encryption, which leaves it readable on the network. So the safe answer is not yes or no, but yes if you check three things first.

This guide covers those checks, the settings to change, and the one tool that helps. It follows the guidance of the FTC, the US cybersecurity agency CISA, and the Federal Communications Commission, the FCC. The steps take about five minutes, and you only need to do most of them once.

What public Wi-Fi can and cannot see

When you visit a website, your browser shows a small lock symbol and the letters https at the start of the address. The s stands for secure, and it means the connection is encrypted. Anyone watching the network sees only scrambled data and the name of the site, not your password or what you typed. Look for that lock on every page, not just the login page. If a page shows a not secure warning, do not type anything sensitive into it.

Most major sites and banking apps encrypt everything now, which is why the FTC calls public Wi-Fi usually safe. Your email app, your bank app, and the big shopping sites all use encryption by default. The risk that remains is a site or app that does not encrypt. That is rare today, but it still happens on smaller sites and older apps. If you are unsure whether an app encrypts, treat it like a site without a lock and wait until you are home.

Encryption does not protect you from yourself. It cannot tell a real bank page from a fake one, and it cannot stop you typing a password into a scam site. It also does not hide which sites you visit from the network owner, who can see the site names even when the content is scrambled. Keep that in mind on a work or school network, where the owner may log what you visit.

The fake network trick: check before you connect

The most common public Wi-Fi attack is the fake network, sometimes called an evil twin. Someone sets up a hotspot with the same name as the real one, often with a stronger signal, and waits for phones to join it. Once you are connected, they can watch unencrypted traffic, redirect you to fake login pages, and collect whatever you type. The network name alone tells you nothing, because anyone can copy it.

The fix is simple: confirm the name before you connect. Ask a member of staff for the exact network name, or check a sign at the counter. If two networks look almost the same, ask which one is real. That one check defeats the whole trick. A network that never asks for a password is not automatically unsafe. It has no encryption of its own, though, so the lock symbol matters even more on it.

Watch the sign-in page too. Many hotspots show a page asking you to accept terms or enter a code from a receipt. That is normal. A page asking for your email password, your bank login, or a payment card is not normal, and you should disconnect at once. If the page looks wrong in any way, close it, forget the network, and ask staff whether the sign-in page is theirs.

Five settings to change before you join public Wi-Fi

These five changes take a few minutes, and most of them are one-time settings. Auto-join is the one to check first, because a phone that joins networks by itself can join a fake one without you noticing. Forgetting the network after each visit does the same job by hand. It is worth doing for hotel and airport networks you will not use again.

Keep your device updated as well. Updates patch the flaws that attackers try to use on public networks, and the FTC lists them as part of staying safe. Turn on automatic updates if you have not already, so the patches arrive without you thinking about them. An old phone with unpatched software is the easiest target on any network.

1. Turn off auto-join for public networks. On iPhone, go to Settings > Wi-Fi, tap the info button next to a saved network, and turn off Auto-Join. On Android, open Settings > Network & internet > Internet > Saved networks, tap the network, and turn off auto-connect if it is shown.
2. Set your laptop to Public. On Windows, open Settings > Network & internet > Wi-Fi, tap the network name, and under Network profile type pick Public network. Your computer then hides itself from other devices on the network and stops sharing files with them.
3. Set AirDrop to contacts only. On iPhone, go to Settings > General > AirDrop and pick Contacts Only or Receiving Off. That stops strangers on the same network sending you files.
4. Turn on two-step verification for email, banking, and social media. Even if a password is stolen, the thief still needs the code from your phone. This is the single setting that does the most after encryption.
5. Forget the network when you leave. On iPhone, go to Settings > Wi-Fi, tap the info button, and tap Forget This Network. On Android, go to Settings > Network & internet > Internet, touch and hold the network, and tap Forget. Your phone then cannot reconnect to a lookalike later.

When a VPN helps, and when it does not

A VPN, short for virtual private network, encrypts all the traffic between your device and the VPN company. Other people on the public network then see only scrambled data, even on sites that do not encrypt. The FTC says this can help if you often log in to accounts over public Wi-Fi. It is the one tool that covers the gaps encryption leaves, and it is worth having if you work from cafes and airports often.

A VPN is not a magic shield. The VPN company can see your traffic instead of the network owner, so you are trusting one company rather than another. Check what a VPN does with your data before you install it. Be wary of any free VPN that does not explain how it makes money.

A VPN also does not make you anonymous, and it does not make a bad site safe. It hides your traffic from the network, not from the site you visit, and it does nothing about a fake login page. Use it as one layer, next to the lock symbol and the settings above, not as a replacement for them. If you only check email and read news on public Wi-Fi, you may not need one at all.

Myths you can ignore about public Wi-Fi

The first myth is that a password-protected network is safe. A shared password only keeps strangers off the network, and everyone in the cafe knows it. Once you are in, the same rules apply: check the lock symbol and the network name. A network with a password on a slip of paper at the counter is no safer than an open one for the things that matter.

The second myth is that only banking is at risk. Your email is the real prize, because a hacker who controls it can reset your other accounts. Social media and shopping accounts matter too, and a stolen session can let someone act as you without your password. Use the same care for every login, not just money.

The third myth is that public USB charging ports are safe. The FCC warns about juice jacking, where a tampered charging port can copy data from your phone while it charges. Use your own charger and cable plugged into a wall socket, or carry a small power bank. A charging-only cable, which carries power but no data, also works if you have one.

Quick answers

Is it safe to do banking on public Wi-Fi?

It is usually safe if the bank's site or app shows the lock symbol, because the connection is encrypted. Using your own mobile data for banking is safer when you can, because it is a network only you use. Never bank on a network you have not checked by name.

Does a VPN make public Wi-Fi completely safe?

No. A VPN encrypts your traffic so others on the network cannot read it, but the VPN company can see it instead. It does not protect you from fake websites or a stolen password. Use it with the lock symbol and the settings in this guide, not instead of them.

How do I know if a Wi-Fi network is fake?

You cannot tell from the name alone, because anyone can copy it. Ask staff for the exact name, and be suspicious of two networks that look almost the same. If the sign-in page asks for an email or bank password, disconnect at once.

Should I forget a public network after using it?

Yes. Forgetting stops your phone joining it again by itself, which protects you from a lookalike network with the same name later. On iPhone, use Settings > Wi-Fi and tap Forget This Network. On Android, use Settings > Network & internet > Internet and tap Forget.

Is hotel Wi-Fi safer than coffee shop Wi-Fi?

Not really. Both are shared networks you do not control, and both can have fake copies. Hotel Wi-Fi sometimes asks for a room number, which proves little. Use the same checks on both: confirm the name, look for the lock, and forget the network when you check out.