The Traditional Warnings
For over a decade, security advice about public Wi-Fi has been apocalyptic: never do banking on public Wi-Fi, never check email at a coffee shop, always assume someone is watching. This advice was largely correct in the era when most web traffic was unencrypted. An attacker on the same Wi-Fi network could trivially read HTTP traffic and intercept credentials sent in plain text.
The internet has changed substantially since those warnings were first issued. Understanding what has changed, and what has not, is essential for making rational decisions about public Wi-Fi use.
What Has Changed: The HTTPS Revolution
The single biggest change in public Wi-Fi security is the near-universal adoption of HTTPS. As of recent measurements, over 95% of web browsing traffic is encrypted via HTTPS. This means:
- Login credentials submitted to websites using HTTPS are encrypted in transit and cannot be read by someone sniffing Wi-Fi traffic
- Session cookies on HTTPS sites are not visible to network eavesdroppers
- Banking and financial sites universally use HTTPS with additional security headers
- Email providers use encrypted connections for webmail and IMAP/SMTP
An attacker on the same public Wi-Fi network cannot see the content of your HTTPS connections. They can see which domains you visit (via DNS queries and TLS handshake data), but not the specific pages, credentials, or data exchanged.
What Remains Genuinely Risky
Captive Portal Attacks
Many public Wi-Fi networks use captive portals, the login pages that appear when you first connect. A malicious access point can present a convincing captive portal that:
- Harvests credentials by mimicking a familiar login page
- Requests unnecessary personal information under the guise of "registration"
- Installs configuration profiles on mobile devices that can redirect traffic
Rogue Access Points
An attacker can create a Wi-Fi network with the same name as a legitimate one (such as "Starbucks_WiFi" or "Airport_Free_WiFi"). Your device may connect automatically if it has previously joined a network with the same name, potentially routing your traffic through the attacker's device.
DNS Spoofing
If you are using the network's DNS server (which is the default), the network operator can return false DNS responses, potentially redirecting you to a fake version of a website. Modern browsers mitigate this with HSTS (HTTP Strict Transport Security) for major sites, but the protection is not universal.
Unencrypted Application Traffic
While web browsers enforce HTTPS effectively, some applications may still communicate over unencrypted channels. Older email clients, certain IoT companion apps, and poorly built mobile applications may transmit data in plain text regardless of network security.
Network-Level Metadata
Even with HTTPS, a network observer can see:
- Which domains you connect to via DNS queries
- The volume and timing of your traffic which can reveal usage patterns
- Your device's MAC address which can be used for tracking across locations
What Is Mostly Hype
"Someone will steal your banking credentials." If your bank uses HTTPS (they all do), your credentials are encrypted in transit. An attacker on the same network cannot extract them from encrypted traffic.
"You should never check email on public Wi-Fi." Major email providers all use encrypted connections. Unless you are using an email client configured for unencrypted IMAP from a decade ago, your email is protected.
"VPNs are absolutely essential on public Wi-Fi." VPNs provide meaningful privacy benefits by hiding which domains you visit and encrypting DNS queries, but they are not the critical safety tool they were a decade ago for most common activities. The risk of not using a VPN on public Wi-Fi is primarily a privacy concern, not a credential theft concern.
Reasonable Precautions
Use DNS Over HTTPS (DoH) or DNS Over TLS (DoT)
Configure your device to use encrypted DNS, which prevents the network operator from seeing your DNS queries. Most modern operating systems and browsers support this natively.
Forget Networks After Use
Configure your device to avoid automatically reconnecting to public Wi-Fi networks. On most devices, you can set networks to not auto-join or remove them from your saved networks list after each use.
Verify HTTPS Indicators
Before entering credentials on any website while on public Wi-Fi, verify the padlock icon and that the domain name is correct. This is good practice on any network but is especially important on untrusted ones.
Use a VPN When Privacy Matters
If you do not want the network operator to see which domains you visit, a VPN is a practical solution. Choose a reputable, paid VPN provider rather than free services that may monetize your traffic data.
Keep Software Updated
Ensure your operating system and browser are current. Updates include security fixes that protect against network-level attacks and improve HTTPS enforcement.
Disable File Sharing and AirDrop
Turn off file sharing, AirDrop, and similar discovery features when connected to public networks to prevent unwanted connection attempts from nearby devices.
The Bottom Line
Public Wi-Fi in the modern era is considerably safer than it was ten years ago, thanks primarily to widespread HTTPS adoption. The most realistic threats are rogue access points and metadata exposure, not credential theft from encrypted connections. Take proportionate precautions, stay aware of your surroundings, and ensure your broader digital hygiene is solid.
Check LeakedSource to verify that your credentials are not already compromised from data breaches, which remains a far greater risk to most people than any public Wi-Fi threat.