Public Wi-Fi is fine for everyday browsing on secure (HTTPS) websites, but it isn’t private. The people running the network can see which sites you visit, and a fake hotspot can capture what you type. Turn on a VPN, check the network’s exact name with staff, and save banking for connections you trust.
That free hotel or café connection is convenient, and most of the time nothing bad happens. The risks are real, though, and they’re easy to reduce once you know what they are. This guide explains them in plain English, then gives you a checklist you can follow on any network.
Who can see what on public Wi-Fi?
| Who | Without a VPN | With VPNFast on |
|---|---|---|
| The network owner (hotel, airport, café) | Which websites you visit and when; everything on pages and apps that don’t use encryption | That you’re connected to a VPN server, and how much data you use |
| Other people on the same network | On open or poorly secured networks, the same as above, using freely available tools | Only scrambled, encrypted data |
| A fake hotspot (an “evil twin”) | Everything it can capture, plus any password you type into a fake sign-in page | Only encrypted data, once the VPN is connected |
| The websites you visit | Your real IP address and roughly where you are | The VPN server’s IP address and location |
The short version: without a VPN, the network sees your destinations. With a VPN, it only sees that you’re using one.
The real risks, in plain English
1. Fake hotspots (“evil twins”)
An attacker creates a network with the same name as the real one, such as “Airport_Free_WiFi”, often with a stronger signal. Your device connects, and the attacker’s equipment sits in the middle of everything you send. The US Cybersecurity and Infrastructure Security Agency (CISA) describes these “evil twin” attacks in its guide to securing wireless networks. It warns that the attacker can read data such as card numbers and passwords. CISA’s advice: confirm the network’s name and password before you connect.
2. Networks with no encryption
Many public hotspots have no password at all. On those, the Wi-Fi signal itself isn’t encrypted, so anyone nearby with the right software can pick up the traffic. According to CISA, that can expose passwords or card details on any connection that isn’t otherwise protected. A password-protected network (WPA2 or newer) is better, but in a café everyone shares the same password, so it isn’t private either.
3. Apps and sites that skip encryption
Most websites now use HTTPS, which encrypts the page between you and the site. Not everything does, though: some older sites, smart devices and apps still send data in the clear. On public Wi-Fi, that data is readable by the network.
4. Your device being open to others
If file sharing is switched on, other people on the same network may be able to see shared folders on your laptop. CISA recommends turning sharing off whenever you’re on a public network.
5. The low-tech stuff
Someone reading your screen over your shoulder, or a laptop left on a café table, can cost you more than any hacker. CISA lists both as public Wi-Fi risks too.
Does HTTPS make public Wi-Fi safe?
It helps a lot, but it doesn’t cover everything. HTTPS (the padlock in your address bar) encrypts the content of a page, so the network can’t read your messages or what you type into that site. It doesn’t hide:
- which websites you visit, because your device looks up each site’s name, and the network can see those lookups;
- traffic from apps that don’t use encryption;
- a fake sign-in page. If you type your password into a lookalike page on a fake hotspot, HTTPS on the real site won’t help.
A VPN closes the first two gaps: it encrypts everything between your device and the VPN server, including those lookups, for every app at once. For the third, your own caution is still the best protection; see step 3 below.
How to use public Wi-Fi safely: a 9-step checklist
- Confirm the exact network name. Ask staff or check the official sign in the hotel lobby or airport. Be suspicious of near-identical names and of networks called just “Free WiFi”.
- Prefer networks with a password, and avoid open ones for anything personal. A shared password still isn’t private, so keep reading.
- Sign in to the Wi-Fi login page first, then turn on VPNFast right away. Many hotel and airport networks show a sign-in page, and the VPN can only connect after that. Be careful on these pages: never enter your email password there, and only give card details on a sign-in page you were expecting, like a hotel’s own paid Wi-Fi.
- Keep the kill switch on. Public networks drop often. VPNFast’s kill switch stops your traffic until the VPN reconnects, so nothing is sent unprotected in the gap.
- Look for HTTPS and never ignore certificate warnings. If your browser says a connection isn’t private, close the page. On public Wi-Fi, that warning can mean someone is in the middle.
- Turn off file sharing. On Windows, mark the network as public; on a Mac or iPhone, set AirDrop to Contacts Only (see the table below).
- Don’t let your device join networks automatically. Turn off auto-join for networks you don’t trust, and “forget” a network when you leave the hotel or airport.
- Turn on two-step sign-in and keep updates on. Even if a password is stolen, a second step stops most break-ins. CISA explains how in Turn On MFA. Updates fix the security holes attackers look for; see CISA’s Update Software.
- Do your banking and payments on a VPN or mobile data. If you can’t use either, wait until you’re on a network you trust.
Settings worth changing before you travel
Menu names vary a little between versions, so look for similar wording on your device.
| Device | Stop auto-joining | Turn off sharing |
|---|---|---|
| iPhone / iPad | Settings › Wi-Fi › tap ⓘ next to the network › turn off Auto-Join | Settings › General › AirDrop › Contacts Only |
| Android | Settings › Wi-Fi › tap the network › turn off Auto reconnect (or tap Forget) | Turn off Nearby Share or Quick Share visibility for everyone |
| Mac | System Settings › Wi-Fi › click the network’s details › turn off Automatically join | Control Center › AirDrop › Contacts Only; System Settings › General › Sharing › turn off File Sharing |
| Windows | Settings › Network & internet › Wi-Fi › turn off Connect automatically for that network | Same Wi-Fi settings › set the network profile to Public network |
Then install VPNFast on each device you travel with: iPhone and iPad, Android or Mac. Our step-by-step VPN guide shows the setup on each one.
What a VPN does on public Wi-Fi (and what it doesn’t)
What it does:
- Encrypts everything between your device and the VPN server. VPNFast uses AES-256 encryption, so the network, others on it and any fake hotspot see only scrambled data.
- Hides which sites you visit from the network. VPNFast sends your lookups through its own private DNS, with leak protection.
- Replaces your IP address, so websites see the VPN server’s location instead of yours.
- Keeps you covered when the connection drops, thanks to the kill switch.
- Helps block known harmful sites with VPNFast’s threat protection.
What it doesn’t do:
- Stop you typing details into a fake page. If you hand a password to a phishing page, the VPN can’t take it back.
- Hide shared folders on your device. Turn file sharing off anyway.
- Replace updates and two-step sign-in. Use all three together.
- Make you anonymous. Accounts you sign in to still know it’s you.
If you’re new to VPNs, start with What is a VPN and how does it work?. For the bigger picture, see the benefits of using a VPN.
Hotels, airports and cafés: what’s different
Hotels. Guests usually share one network, often with a login using your room number. Sessions run for days, so it’s easy to forget you’re on a shared connection. Turn on VPNFast right after logging in, and forget the network when you check out.
Airports. Busy terminals are where lookalike networks are most common, because people connect in a hurry. Check the official network name on the airport’s signs or website before you connect, and avoid entering personal details on the sign-in page.
Cafés and coworking spaces. The password is usually written on a board for everyone, so treat the network as open. Keep the VPN on for your whole visit, and don’t leave your laptop unlocked when you step away. On an iPhone, here’s why a VPN matters even more.
FAQs
Is it safe to do online banking on public Wi-Fi?
It’s best avoided without protection. Banking sites and apps use encryption, but a fake hotspot or a fake sign-in page can still trick you. Turn on a VPN first, or switch to your phone’s mobile data for anything involving money.
Can someone see my browsing history on public Wi-Fi?
The network owner, and sometimes other people on the same network, can see which websites you visit, even on HTTPS sites. They can’t read the content of encrypted pages. With a VPN on, they only see that you’re connected to a VPN.
Is a password-protected Wi-Fi network safe?
It’s safer than an open one, because the Wi-Fi signal is encrypted. But in a hotel or café everyone shares the same password, so other people on the network aren’t kept out. Treat it as public and use a VPN.
Should I turn on my VPN before or after the Wi-Fi login page?
After. Most hotel and airport networks block all traffic, including the VPN, until you accept the terms or sign in. Connect, complete the login page, then turn on VPNFast straight away.
Is mobile data safer than public Wi-Fi?
Usually, yes. Mobile data connections are encrypted between your phone and the carrier, and strangers can’t join your connection the way they can join a café’s Wi-Fi. Your carrier can still see which sites you visit, so a VPN is still worth using if that matters to you.
Stay safe on any network. VPNFast is free to download on iPhone, Android, Mac, Windows, Chrome, Fire TV and Google TV. One Premium plan covers up to 5 devices and adds 1500+ servers in 190+ countries. See plans and pricing.
