Public Wi-Fi is safer than it was a decade ago because most sites and apps use encrypted connections, but it is not risk free. The bigger dangers now are fake networks, fake login pages and tricking users into approving prompts. Sensible habits plus a managed device make it acceptable for most work.
Myth: anyone on the network can read everything you do
Mostly outdated. Most websites and apps use TLS, which encrypts content between your device and the service. A person on the same network can still see which hosts you connect to, and may learn timing and volume, but not page contents.
The Wi-Fi Alliance notes that its Enhanced Open feature provides unauthenticated data encryption on open networks, so even a network with no password can encrypt each user's traffic when both sides support it. That is an improvement over plain open Wi-Fi, though it does not prove who runs the network.
Fact: you cannot tell who runs the network
This is the real weakness. A name like "Airport Free WiFi" proves nothing. An attacker can run the same name, which is the evil twin problem covered in evil twin access points. Joining it hands the attacker a chance to interfere with traffic, redirect you to look-alike pages, or prompt for a login.
Myth: a captive portal login makes the network trustworthy
The portal only controls access to the internet for that venue. Entering an email or room number there does not authenticate the network to you. Never enter a work password into a portal page.
Fact: certificate warnings matter more than the Wi-Fi icon
If a browser shows a certificate warning on public Wi-Fi, stop. That is often the visible sign of interference. Do not click through.
Myth: a VPN makes public Wi-Fi perfectly safe
A tunnel protects traffic between your device and the VPN endpoint. It does not protect you from phishing, from malware already on the device, or from a bad provider. It is a good layer, not a cure. More on that in what a VPN does not hide.
Practical rules that work
- Keep the device updated and disk encrypted.
- Turn off automatic file sharing and auto join for open networks.
- Use a phone hotspot for sensitive work when you can.
- Use your company tunnel when connecting to internal systems.
- Use a password manager, which will not fill credentials on a look-alike domain.
- Use MFA that resists phishing for key accounts.
- Do not approve MFA prompts you did not trigger.
What companies should set up
Give staff a short written rule, not a lecture. Enforce what you can with device management: forget open networks, block automatic join, require the tunnel for internal apps, and turn on DNS filtering on the device.
Quick check
Is hotel Wi-Fi riskier than a cafe?
Not inherently. Both are shared networks with unknown operators. Treat them the same and rely on encrypted connections and device hygiene.
Should I avoid banking on public Wi-Fi?
Banking apps use encrypted connections, so it is usually fine, but a phone hotspot removes the question entirely if you have one.
Sources
Last reviewed: 19 October 2026.
