Is Public Wi-Fi Safe? A Plain-English Guide for Travel, Cafés and Hotels

Coffee shops, airports, hotels, libraries and hospitals all offer free Wi-Fi, and most of us use it without a second thought. So is public Wi-Fi safe? The honest answer is “mostly, these days,” with a few exceptions worth knowing. The Federal Trade Commission (FTC) notes that most websites now encrypt the information you send, which makes public Wi-Fi much safer than it was a decade ago. The remaining risks come from fake networks, unpatched devices and a few bad habits.

This guide explains what public Wi-Fi can and can’t expose, the simple settings that help, when a VPN is worth it, and how to keep phones and laptops safe while traveling. It was checked against the FTC on November 6, 2026.

What public Wi-Fi can expose

When you connect to a public network, other people on that network, or whoever runs it, may be able to see some of your traffic. What they can see depends on encryption:

• Websites and apps that use encryption scramble your information between your device and the site. The FTC says to look for “https” at the start of the web address on every page, not just the login page. Most major sites and banking apps encrypt everything.
• The network itself may or may not be encrypted. The FTC notes that many public networks don’t use encryption, and if you aren’t sure, assume a network isn’t secure.
• Some details can still leak, such as which sites you visit, even when the pages themselves are encrypted.

The real risks today

• Fake hotspots. A scammer sets up a network with a believable name, such as “Airport_Free_WiFi” or the hotel’s name, to lure people in. A fake sign-in page may then ask for your email password or card details.
• Fake “captive portal” pages. The page that pops up when you join hotel or airport Wi-Fi is normal, but it should only ask for a room number, last name or to accept terms. It should never ask for your email password, and it rarely needs a card unless you’re paying for access you expected.
• Out-of-date devices. Old software has known security holes. Updates matter more than the network.
• Shoulder surfing and theft. In public, the biggest risks are often someone watching you type a passcode, or a laptop left on a table.

Simple steps that make the biggest difference

1. Confirm the network name. Ask staff or check a sign for the exact name before you connect. If two networks look alike, ask.
2. Use apps and https sites. Official banking and shopping apps encrypt your data. If a site shows a “not secure” warning, don’t type anything sensitive.
3. Never enter your email password on a Wi-Fi sign-in page.
4. Keep your devices updated, and turn on automatic updates.
5. Turn on two-step verification for email, banking and social media, so a stolen password alone isn’t enough. See our two-step verification guide.
6. Turn off auto-join for public networks, and “forget” a network when you leave so your phone doesn’t reconnect to a lookalike later.
7. Turn off file sharing and AirDrop for everyone. On a Mac or PC, set the network as “public” so your computer isn’t visible to others. On iPhone, set AirDrop to Contacts Only or Receiving Off.
8. Log out when you’re done on any shared or public computer, such as a hotel business center. Better yet, don’t sign in to important accounts on a computer you don’t control.

Is a VPN worth it?

A virtual private network (VPN) encrypts the traffic between your device and the VPN company, so others on the public network see only scrambled data. The FTC notes that this can help on public Wi-Fi, but also warns that not every VPN app actually encrypts your information, and the VPN company can see your traffic instead. If you use one:

• Choose a well-known provider with a clear privacy policy, not a random free app.
• Remember a VPN doesn’t stop phishing, scam websites or malware.
• For most people, using encrypted apps and your phone’s own data is just as good for everyday browsing.

When to use your phone’s data instead

For banking, paying bills or anything you’d hate to lose, your phone’s cellular data is generally safer than public Wi-Fi. You can also turn on your phone’s personal hotspot to connect a laptop. Set a strong hotspot password so strangers can’t join.

Charging in public

Public USB charging ports at airports and hotels are convenient, but the Federal Communications Commission (FCC) has advised travelers to avoid them where possible, because a tampered port could in theory be used to install malware or copy data. The FCC also says it isn’t aware of any confirmed cases, so this is a low risk with an easy fix. The simple fix is to bring your own charger and plug it into a regular wall outlet, or carry a portable battery. If your phone asks whether to share data or “trust this computer” when you plug in to charge, choose “charge only” or Don’t Trust.

Travel tech checklist before you leave

• Update your phone, laptop and tablet.
• Turn on Find My (Apple) or Find My Device (Android), and make sure a strong passcode and Face ID or fingerprint are set.
• Back up photos and important files.
• Save your bank’s and card issuer’s fraud numbers in your phone and on paper.
• Pack your own charger, cable and a portable battery.
• Know how to remotely lock or erase a lost device. Our lost phone guide explains how to get back into accounts if your phone goes missing.

Kids and teens on public Wi-Fi

Parental controls built into a phone or tablet, such as Apple Screen Time and Google Family Link, generally keep working on any network, but filters set up on your home router don’t travel with the device. Before a trip, check your child’s device-level settings and remind them never to sign in to anything on a pop-up Wi-Fi page. See iPhone Screen Time and Google Family Link.

FAQ

Is it safe to check my bank account on public Wi-Fi?

Using your bank’s official app on an up-to-date phone is generally low risk, because the app encrypts your connection. For extra peace of mind, switch to cellular data for banking.

Is hotel Wi-Fi safer than coffee shop Wi-Fi?

Not necessarily. A password, such as one given at check-in, keeps casual strangers off the network but everyone with that password can still join. Treat any shared network as public.

Do I need antivirus on my phone?

For most people, keeping the phone updated and installing apps only from the official app store does more than a third-party antivirus app. On a Windows computer, the built-in Microsoft Defender is a solid baseline.

What should I do if I joined a fake network?

Disconnect and forget the network. If you typed a password on its sign-in page, change that password right away and turn on two-step verification. Our guide to what to do after clicking a phishing link has the full steps.

Related guides

• How to Secure Your Home Wi-Fi Router, Step by Step
• Travel and Timeshare Scams
• QR Code Scams
• Passkeys Explained: What They Are and How to Set Them Up
• Get Help Now After a Scam or Hack

Sources

• Federal Trade Commission, “Are Public Wi-Fi Networks Safe? What You Need To Know,” consumer.ftc.gov, accessed November 6, 2026.
• Federal Communications Commission, “What is ‘Juice Jacking’ and Tips to Avoid It,” fcc.gov, accessed November 6, 2026.

This is general information, not technical advice. Device settings change over time; check your device maker’s help pages for current steps.