Public Wi-Fi: What the Actual Risk Is Now

For years the advice was that public wifi is dangerous and a VPN is essential. That advice was accurate when most web traffic was unencrypted. Nearly all of it is encrypted now, and the risk profile changed accordingly.

What used to be true

A decade ago, a substantial share of websites transmitted in plain text. Anyone on the same network could read the traffic, including session cookies, which allowed straightforward account hijacking. Tools existed that made this trivial.

That is the world the warning was written for.

What changed

HTTPS is now near-universal. Browsers mark unencrypted pages as insecure, certificates are free, and search rankings favour encryption. Someone watching the network sees encrypted connections.

Certificate validation is enforced. A fake certificate produces a warning that is deliberately difficult to bypass.

Apps pin certificates. Many mobile applications reject any certificate other than the expected one, so interception fails outright.

HSTS prevents downgrade. Sites can instruct browsers never to connect unencrypted, closing the older attack of forcing a plain-text connection.

The result is that passively reading someone's traffic on a café network yields very little.

What remains genuinely true

Metadata leaks. Which sites you connect to remains visible even when the content does not, through DNS queries and connection destinations. Encrypted DNS reduces this and is now on by default in several configurations.

Unencrypted traffic still exists. Older applications, some devices, some background services.

Malicious networks exist. An access point named to resemble the venue's, operated by someone else, can capture what is unencrypted and attempt interception on what is not. Modern clients defeat most of this, and it remains a real category.

Captive portals are a phishing surface. The sign-in page a network forces you through is an ideal place to imitate. Never enter credentials for anything real into a captive portal, and never install a certificate or a profile a network asks for. That request is a genuine warning sign.

Automatic reconnection. A device that remembers an open network will reconnect to anything using the same name. This is worth turning off for open networks.

Local network exposure. Other devices on the same network can attempt to reach yours. File sharing on a public network is a real exposure and both platforms ask about network type for this reason.

Whether a VPN helps

It genuinely does two things: it hides your destinations from the local network and the venue, and it protects whatever unencrypted traffic remains.

It does not make you anonymous, does not stop tracking, and does not protect against phishing or malware.

It moves trust rather than removing it. Your traffic is visible where it exits the VPN provider's server. You have replaced the café operator with the VPN operator, and whether that is an improvement depends entirely on the provider.

Free VPNs are frequently worse than the network you are avoiding, because the business model requires monetising traffic somehow.

Verdict: worth using on untrusted networks if you already have a provider you have reason to trust. Not the emergency that advertising implies, and not a substitute for the measures below.

What actually matters more

A second factor on your accounts. Protects against credential theft regardless of network.

Keeping devices updated. Interception attacks target known flaws.

Not entering credentials into captive portals or unexpected prompts.

Turning off sharing on public networks, and letting the operating system treat them as public.

Cellular data instead, where available. Tethering to your phone avoids the question entirely and is frequently faster.

Not installing certificates or profiles at a network's request, ever.

The situations that still warrant care

Hotel and conference networks, which are frequently poorly maintained and used by many strangers for extended periods.

Networks in places where surveillance is a genuine concern, where destination metadata matters more than content.

Devices that cannot be updated — older tablets, embedded equipment — which may still negotiate weak connections.

Anything unusually sensitive, where the small residual risk is not worth taking. Use cellular.

The proportionate summary

Checking email on café wifi on a current phone is not the hazard it once was. The encryption did what it was supposed to do.

The remaining risks are metadata, deliberately hostile networks, and being tricked at a sign-in page. A VPN addresses the first two partially. Nothing addresses the third except not entering credentials into things that ask unexpectedly.