The standard advice about public Wi-Fi is that anyone on the network can see what you are doing, so never bank on it and always use a VPN. That was substantially true once. It is largely not true now, and repeating it obscures the risks that do still exist.
Nearly all web traffic is encrypted end to end. Someone on the same network sees that you connected to a bank, and not your credentials, your balance, or anything you typed. The eavesdropping threat the advice was written for has mostly been engineered away.
What changed in 2026
- Encryption became effectively universal. Browsers warn on unencrypted connections, and the plaintext web that made packet sniffing productive is essentially gone.
- Encrypted DNS spread. Where enabled, it closes the gap where lookups revealed which sites you visited even when the traffic was encrypted.
- VPN marketing stayed ahead of VPN reality. Advertising continued describing threats that HTTPS already addressed.
- Attacks moved up the stack. With transport encryption solved, the productive attacks became fake networks, malicious captive portals, and tricking users into ignoring warnings.
What is and is not protected
| Risk |
Still real? |
What addresses it |
| Reading your passwords in transit |
No |
HTTPS, already on |
| Reading page contents |
No |
HTTPS |
| Seeing which sites you visit |
Partly |
Encrypted DNS, VPN |
| Fake network impersonating a real one |
Yes |
Verify the name; do not auto-join |
| Malicious captive portal |
Yes |
Never install anything it offers |
| Certificate warnings you dismiss |
Yes |
Never dismiss them |
| Old apps using plaintext |
Occasionally |
Keep software updated |
| Shoulder surfing |
Yes |
Situational awareness |
The first two rows are what the old advice was about, and they are handled. The rows that matter now are mostly about being tricked rather than being intercepted.
The risks that remain
Fake networks. An attacker runs a network named plausibly — the café's name, or "Airport_Free_WiFi" — and you join it. They now control your DNS and your routing. HTTPS still protects the contents of your connections, and they can see where you go, redirect you to lookalike sites, and present a captive portal that asks for things a real one would not.
The defence is unglamorous: confirm the network name with staff rather than guessing, and turn off automatic joining of open networks. Auto-join is the mechanism by which your phone connects to a hostile network without you doing anything at all.
Malicious captive portals. The page that appears when you join. A hostile one may ask you to install a certificate or an app "to connect". Never do either. A legitimate portal asks you to accept terms or enter a room number. It does not need to install software on your device, and anything that asks is attempting to break the encryption that is protecting you.
Certificate warnings. Your browser telling you a certificate is invalid on public Wi-Fi is the one signal that genuinely indicates interception. This is exactly the situation the warning exists for. Do not click through it. Close the page.
What leaks outside the browser. Older or badly-written apps may not verify certificates properly or may use unencrypted connections. You cannot inspect this easily, which is a reasonable argument for keeping software updated and for not using unfamiliar apps for sensitive things on untrusted networks.
Where a VPN actually helps
A VPN encrypts everything between your device and the VPN server. That is genuinely useful for specific things.
It hides which sites you visit from the network operator — the metadata HTTPS does not conceal. It protects any traffic from an application that failed to encrypt properly. It gets around network-level blocking. And it makes you appear to be somewhere else, which has its own uses.
What it does not do is make encrypted traffic more encrypted. Your bank session was already secure.
It also relocates trust rather than eliminating it. Your traffic metadata now goes to the VPN provider instead of the café, and that provider is a company with a business model, jurisdiction, and logging policy. A free VPN in particular is being paid somehow, and the traffic is frequently the product.
The reasonable position: a VPN is a fine tool bought for what it does. Buying one because you believe public Wi-Fi exposes your passwords is buying it for a threat that mostly does not exist any more.
Mobile data is worth mentioning as the simpler answer. Tethering to your phone avoids the untrusted network entirely, and for anything genuinely sensitive on an unfamiliar network it is the least complicated option.
Common mistakes
- Dismissing certificate warnings. The one warning that reliably means interception.
- Installing anything a captive portal offers. No legitimate portal needs to.
- Leaving auto-join enabled for open networks. Your device connects to hostile networks unprompted.
- Assuming a VPN makes everything safe. It moves trust; it does not eliminate risk.
- Using a free VPN for privacy. The economics do not work in your favour.
- Guessing the network name. Ask; lookalike names are the whole attack.
- Leaving sharing enabled. File sharing and network discovery should be off on untrusted networks.
FAQ
Can I bank on public Wi-Fi?
Technically yes — the connection is encrypted. Whether you should depends on your comfort with the surrounding risks, and using mobile data instead costs nothing and removes the question entirely.
Is a hotel network safer than a café's?
Not inherently. Hotel networks are frequently worse, since they are widely accessible, often poorly maintained, and captive portals there have historically been used to push software.
What about my phone versus my laptop?
Mobile operating systems are generally more locked down, and the network-level risks are identical. The device matters less than the network and your behaviour on it.
Does encrypted DNS remove the need for a VPN?
It closes the DNS leak specifically, which is a meaningful part of what a VPN hides on a hostile network. It does not hide destination addresses at the connection level, so it is a partial rather than complete substitute.
Where to go next
For the account protection that matters more than network choice, read security keys explained and passkeys vs 2FA. For reducing what a network operator can learn about you generally, DNS explained.