Is Public Wi-Fi Actually Safe to Use?

Public Wi-Fi is far safer than its reputation, and the classic scare story is mostly obsolete. You’ve heard it: a hacker sitting in the same coffee shop quietly reads your passwords off the open network. That attack largely stopped working years ago because of one change — nearly every real website now uses HTTPS. Your connection to an HTTPS site is encrypted in transit, between your device and the site’s server, so the stranger at the next table cannot read the contents of your traffic or steal your login, open network or not. What protects you is that encrypted connection your browser negotiates, not the network you’re on. The risks that remain are real, but they’re narrower, and they’re about deception more than eavesdropping.

Why “password sniffing” stopped working#

In the bad old days, plenty of sites sent your username and password in plain text over http://. Anyone on the same network could capture it with free tools. That’s the world the warnings were written for, and it’s gone. Today browsers default to https://, and many sites add HSTS to refuse insecure connections — though HSTS only takes effect after your browser has already seen the site once, or the domain ships on the browser’s hardcoded preload list, so the very first visit to a non-preloaded site over a hostile network isn’t automatically covered. Once a connection is secured, a TLS-encrypted tunnel runs between your device and the site’s server. Someone sharing the Wi-Fi sees encrypted noise — not your email, your bank session, or the password you just typed. The encryption travels with the connection, so it doesn’t matter that the Wi-Fi itself is open and unencrypted. The two layers are independent.

What the browser icon actually tells you#

For years the advice was “look for the padlock.” That cue is fading, and it was always weaker than people thought. Chrome removed the padlock icon in 2023 — Google found users read it as “this site is safe” when it only ever meant “this connection is encrypted” — and swapped in a neutral sliders, or “tune,” icon; on iOS the icon disappeared from the address bar entirely. Edge, also built on Chromium, has been testing the same change. Only Firefox and Safari still show an actual padlock. So the indicator’s shape depends on your browser, and whatever its shape, it is not a verdict on the site’s honesty: a phishing page served over HTTPS shows the exact same icon. What the indicator confirms is narrower — that traffic to that domain is encrypted. Tap it to see connection details; the real thing to watch for is a Not secure label, not the presence of a lock.

The risks that are actually left#

Public Wi-Fi isn’t risk-free; the dangers just moved. Here’s what genuinely matters now.

• Evil-twin hotspots. Anyone can name a hotspot Airport_Free_WiFi. Connect to a fake one and the operator controls your captive portal — the sign-in page — and can steer you toward malicious pages or phony “updates.”
• Certificate warnings you click through. If a site’s identity can’t be verified, your browser throws a full-page warning like Your connection is not private. On a hostile network that warning is often the only sign of an interception attempt, and bypassing it throws away the entire protection.
• Captive-portal tricks. A sign-in page that tells you to “install this certificate” or “download our app to connect” is a red flag. A legitimate Wi-Fi login never needs a root certificate or an app.
• Metadata leakage. Even with HTTPS, the network operator can still see which domains you reach, through DNS lookups and the unencrypted server name (SNI) in the TLS handshake. They see that you visited a bank — not what you did there.

Where a VPN actually helps#

A VPN is useful, but not for the reason it was marketed. It does not add some missing shield to your logins; HTTPS already handles that. What it does is hide which sites you visit from the network operator and cover the rare bit of traffic that still isn’t encrypted. That’s a genuine but modest benefit, and it comes with a catch: a VPN moves your trust from the coffee shop’s router to the VPN company, which can now see your domains instead. Decide based on that trade, not on fear. We break down when it’s worth it in do I need a VPN?.

What doesn’t help at all#

Private or incognito browsing does nothing for network safety. It’s a local-history feature — it clears cookies and browsing history on your own device and has zero effect on what the network can see, as we explain in what incognito mode actually hides. Two other concerns often get blurred into “Wi-Fi safety” but are separate problems. Account security lives with your passwords and two-factor setup, not the network — start with a strong, unique password. And whether a bad download can harm your device is a malware question, covered in do I need antivirus.

Common belief vs. reality#

Common belief	Reality
Anyone on open Wi-Fi can read my passwords	HTTPS encrypts the contents in transit — they see only scrambled data
The lock icon means the site is safe	It only means the connection is encrypted — and Chrome and Edge dropped the padlock for a neutral icon precisely because people misread it
A VPN is essential on public Wi-Fi	Mostly optional now — it hides which domains you visit, little more
Incognito mode keeps me safe on the network	It hides nothing from the network; it only clears local history
The operator can see everything I do online	It sees which domains you connect to, not the contents

The bottom line#

For ordinary browsing, banking, and email, public Wi-Fi is fine — the threat model moved on and the old advice didn’t. The short version of staying safe: keep your OS and browser updated, never click past a certificate warning, don’t type credentials into a sketchy captive portal, and never “install a certificate” to get online. Add a VPN if you specifically want to hide your browsing from the network, understanding that you’re trusting the provider instead. Encryption in transit does the heavy lifting; your only job is not to override it when your browser tells you something’s wrong.