Is Public Wi-Fi Safe in 2026? Real Risks and a Practical Checklist
HTTPS fixed the worst of public Wi-Fi, but fake hotspots and sloppy networks still catch people out; here is what actually helps.
The honest answer for 2026
Public Wi-Fi is genuinely safer than it was a decade ago, because most websites now encrypt traffic with HTTPS, which stops casual password-sniffing cold. But safer is not safe: attackers have adapted with fake hotspots, malicious captive portals, and attacks on what encryption does not cover. The risk today is less about someone reading your email and more about someone controlling the network you joined.
Risk 1: evil twin hotspots
An evil twin is a rogue hotspot named to impersonate the real one: Airport_Free_WiFi with one character changed, or simply a stronger duplicate signal of the same name. Join it and every request flows through the attacker's hardware, which can redirect you to counterfeit login pages, serve poisoned downloads, or strip protections. The equipment fits in a backpack, and busy transit hubs remain the classic hunting ground.
Risk 2: what snoops can still see
Even with HTTPS everywhere, an open network leaks metadata: the sites you contact via DNS lookups, the device names on the network, and any app still making unencrypted calls in the background. Captive portals sometimes demand personal data before letting you online, and fellow guests on a flat network can probe your device directly if its firewall or sharing settings are sloppy.
Your practical protection checklist
Confirm the exact network name with staff before joining, and be suspicious of open networks that a paid venue would normally protect. Turn off auto-join for public networks and forget them after use. Keep your OS and browser updated, disable file sharing outside home networks, and never install anything a captive portal offers you. That handful of habits eliminates most real-world attacks before encryption even matters.
Where a VPN fits in
A VPN wraps everything your device sends, including DNS lookups and stray app traffic, in one encrypted tunnel, which makes even a hostile hotspot mostly blind. It is the single strongest layer for people who live on cafe and airport Wi-Fi. NordVPN adds Threat Protection Pro, which blocks malicious sites and trackers before they load, useful when a rogue portal tries a redirect.
If you only need cover for occasional travel, Proton VPN's free tier is the one no-cost option we trust: unlimited data on one device, no ads, funded by its paid plans rather than your browsing history. Turn it on before you join the network, not after: the tunnel only protects traffic sent while it is active, and the first seconds on a hostile hotspot are exactly when your auto-connecting apps start talking.
Frequently asked questions
Is it safe to check my bank account on public Wi-Fi?
How do I spot an evil twin hotspot?
Does a VPN make public Wi-Fi completely safe?
Related reading
VPNsBest VPN for travel in 2026
Hotel wifi, foreign card machines, and banking apps abroad all get safer with the right VPN installed before departure.
VPNsBest VPN Deals in 2026: How VPN Pricing Really Works
VPN pricing is theater: sticker prices, countdown timers, and renewal jumps all follow a script you can use to your advantage.
VPNsDo You Need a VPN at Home? An Honest Answer for 2026
Home Wi-Fi is not the danger zone public Wi-Fi is, so the case for a home VPN rests on different arguments entirely.