Public WiFi: The Simple Security Rules That Still Matter
Public WiFi is useful, but shared. Learn what HTTPS protects, when to use mobile data, and which simple account habits still matter.
Public WiFi used to come with a simple warning: do not use it for anything important. That advice is too blunt for how the web works now. The better rule is to understand what the network can see, what HTTPS protects, and when to switch to mobile data instead.
The Short Version
Public WiFi is not automatically dangerous, but it is not the same as your home network. Modern HTTPS protects the content of most banking, email and shopping sessions, yet the network may still reveal clues such as the sites you connect to and the timing of your activity. Treat public WiFi as a convenience for ordinary browsing, not as a place to fix account problems, reset passwords or ignore browser warnings.
What Public WiFi Can Actually See
A shared WiFi network sits between your device and the internet. In a cafe, hotel, train station or airport, it may be run well, run badly or copied by someone using a similar name. Think of it as a public route rather than a private room.
The old fear was that anyone on the same WiFi could read everything you typed. That was more realistic when websites commonly used plain HTTP. Today, most important services use HTTPS, which encrypts the connection between your browser and the website. Google Chrome’s help pages still warn that secure sites require you to check the site name.
So what can the WiFi provider still learn? It may see that your device connected, how much data moved, when you were online and, depending on the technology used, which domains your device contacted. It should not be able to read the contents of a properly encrypted banking page, email inbox or payment form. Public WiFi is not magic spyware, but it is not a trusted private connection either.
The Browser Warning Matters More Than The Network Name
When you are on public WiFi, the network name is a weak signal. “Station Free WiFi” may be official, or it may be someone nearby hoping people will connect without checking. A receipt password helps, but it does not make the network private.
Your browser warning is usually more useful. If Chrome, Safari, Edge or Firefox says a page is not secure, do not type passwords, card details, passport numbers or private messages into it. Chrome’s guidance is plain: if a site does not use a private connection, someone may be able to view or change information you send and receive. If the browser shows a full warning page, stop rather than clicking through because you are in a hurry.
Also remember what the secure symbol does not prove. HTTPS helps show that your connection to a particular site is encrypted. It does not prove that the site is honest. If you want a bank, government service or email provider, type the address yourself or use your saved bookmark. Do not follow a link from the WiFi welcome page unless you are only accepting the network terms.
Captive Portals Are Awkward, Not Automatically Sinister
A captive portal is the page that appears before some public WiFi networks let you online. It might ask you to accept terms, enter a room number, use a voucher code or provide an email address. Firefox’s help documentation describes this as common on airport, coffee shop and corporate guest networks.
The practical rule is to keep the portal separate from your real accounts. Use it only to join the network. Do not reuse an important password on a WiFi portal. If the portal asks for more personal information than seems reasonable for free internet access, use mobile data instead.
VPNs can complicate this step because a portal often needs a brief local connection before the internet works. If your VPN blocks the portal, pause it until sign-in is complete, then switch it back on. That is also a useful reminder: the portal is not where your sensitive work should happen.
When To Use Mobile Data Instead
Public WiFi is fine for reading news, checking maps, downloading a podcast, looking up train times or doing low-risk browsing. It is less suitable when the account itself is the thing you are trying to protect. If you are resetting your main email password, handling a fraud alert, uploading identity documents or accessing sensitive work files, mobile data is usually the calmer choice.
This is not because mobile networks are perfect. It is because your personal mobile connection avoids the shared local network, the unknown router and the fake hotspot problem. If your laptop needs internet, tether it to your phone and use a strong phone hotspot password.
The NCSC’s older WiFi guidance still makes a useful distinction: a private WPA2-protected network is more secure than a public WiFi service in a coffee shop or hotel, and sensitive data should travel through encrypted services such as HTTPS or a well-configured VPN.
The Account Habits That Do The Real Work
Public WiFi safety is mostly account safety. If every important account has a unique password, a password manager and two-step verification, a single mistake is less likely to become a full account takeover. If you reuse the same password everywhere, one bad login page can become a much bigger problem.
The NCSC’s public guidance for individuals puts 2-Step Verification and password managers among its first practical steps for staying secure online. That advice fits public WiFi perfectly. A password manager helps because it will usually refuse to fill your password into a fake domain. Two-step verification helps because a stolen password is less useful on its own.
Device updates also matter. The NCSC’s small organisation guidance explains that updates fix bugs criminals could use to hack devices. A fully updated phone or laptop, using a modern browser, is a better defence than a nervous user on an old device clicking through warnings.
If you want to tighten the rest of your setup, our guide to smartphone settings worth changing on day one explains the phone-level checks behind safer browsing, while our explainer on end of support dates shows why old devices become harder to trust.
A Worked Example
Imagine you are in a coffee shop and your laptop finds two networks: “CafeGuest” and “Cafe Guest Free”. The receipt says the official network is “CafeGuest”, so you choose that one. A browser page opens asking you to accept terms. You do that, but you do not create an account, reuse a password or click any promotional login buttons.
Next, you open your email from a saved bookmark. The address bar shows the correct domain, and the browser does not show a security warning. You read messages, but you avoid changing your password because that can wait. A message from your bank asks you to review a payment. Instead of clicking the email link on public WiFi, you switch your phone to mobile data and open the bank app directly.
That is the right shape of caution. You used the network for ordinary browsing. You trusted browser warnings more than the network name. You kept high-stakes account actions on mobile data.
What This Means For You
You do not need to avoid public WiFi completely. You do need a line between convenience and account security. Use it for low-risk browsing when the browser shows a secure connection and the network looks like the one the venue actually provides.
For banking, password resets, identity checks, work files or anything that would cause real trouble if intercepted or misdirected, use mobile data, a trusted private network or a properly managed work VPN. If a browser warning appears, treat it as the decision point. Stop, switch networks or come back later.
The best public WiFi habit is not paranoia. It is choosing the right connection for the job.
In Plain English
Public WiFi is useful, but it is shared. Do not treat it like your home broadband.
If the website is genuinely HTTPS and the address is correct, the contents of the page should be protected from the WiFi network. If the browser says the page is not secure, do not type private information into it.
Use public WiFi for convenience. Use mobile data for sensitive account work.