What Has Changed Since 2015
Ten years ago, open Wi-Fi let anyone on the network sniff your browsing. Sidejacking tools like Firesheep could steal your Facebook session in seconds. Today:
- Over 95% of web traffic uses HTTPS — browsers warn on HTTP sites
- Modern apps use certificate pinning and TLS 1.3 — harder to man-in-the-middle
- DNS is increasingly encrypted (DoH, DoT) so attackers can't see your lookups
- Operating systems block many legacy attacks by default
Result: most everyday browsing (email, banking, shopping) is no longer meaningfully more dangerous on public Wi-Fi than on your home network. Not zero risk, but much lower than the common narrative suggests.
What's Still Genuinely Risky
1. Apps and Sites Without HTTPS
Some older IoT apps, legacy company intranets, and some email clients still use plain HTTP. Those leak content and credentials. Browsers now warn on HTTP sites, making them easier to avoid.
2. Malicious Captive Portals
The login page that pops up in hotels and airports can be imitated. A rogue network with the same SSID as the hotel serves a fake captive portal that asks for your email, credit card, or even a driver's license photo. Real captive portals never need your password to the hotel account; only an access code on the TV or receipt.
3. Evil Twin / Rogue Access Points
Attacker sets up a Wi-Fi network with a similar or identical name to a legitimate one ("Starbucks WiFi" vs "Starbucks_WiFi"). Clients auto-connect if the network is remembered. The attacker sees all DNS queries and unencrypted traffic, and can run SSL stripping attacks on poorly-written apps.
4. DNS Hijacking
The captive portal or network DNS resolver can return forged responses to direct you to phishing clones. HTTPS catches most of this via certificate validation, but only if you notice the warning and don't click through.
5. Unencrypted Legacy Protocols
SMB file sharing, FTP, Telnet, old printer discovery — all plaintext. If your laptop or phone has these services running and you connect to public Wi-Fi, nearby attackers can abuse them. Your OS firewall should block these, but verify.
What HTTPS Already Protects
When you see the padlock in the browser (and the domain is correct):
- Your traffic is encrypted — network operator can't read content
- The server identity is verified — man-in-the-middle is detected
- Your cookies and tokens are protected in transit
- Form data (passwords, credit cards) is encrypted
What HTTPS doesn't hide:
- Which domain you're visiting (visible via SNI and DNS unless you use DoH)
- How much data you send and when (traffic patterns)
- Anything you do after connecting if the site itself is compromised
When a VPN Actually Helps
A VPN routes all your traffic through an encrypted tunnel to a VPN server, then out to the internet. Genuine use cases on public Wi-Fi:
- Hiding which domains you visit from the network operator — useful in censored regions or suspicious networks
- Bypassing captive-portal-based tracking that correlates your traffic patterns
- Protecting against evil-twin DNS manipulation — VPN uses its own DNS
- Accessing work or home resources securely as if you were local
- Regional access (a separate concern from security)
A VPN doesn't add meaningful protection for HTTPS traffic to well-configured sites. It doesn't make malware safer to download. It doesn't prevent phishing. And if the VPN provider is untrustworthy, it's strictly worse than no VPN — you've just handed your entire browsing log to one company.
Which VPNs Are Actually Trustworthy
Avoid free VPNs — they monetize through data collection or ad injection. Choose paid providers with:
- Independent audits of no-log claims (not just marketing)
- Long track record without breaches
- Based in a jurisdiction with real privacy law
- Open-source clients if possible
Major names with reasonable reputations in 2026: Mullvad, IVPN, Proton VPN, ExpressVPN. Research before picking.
Practical Settings for Public Wi-Fi
Before Connecting
- Confirm the network name with staff — don't guess
- Turn on your OS firewall if it isn't already
- Disable file sharing and printer sharing
- Forget public networks after using them to prevent auto-reconnect
While Connected
- Watch for unexpected browser certificate warnings — they're the clearest sign of an attack. Don't click through.
- Don't install software or updates on public Wi-Fi if you can avoid it — wait until you're on a trusted network
- Don't enter the password to your hotel or airline account on a captive portal page — real captive portals use an access code
- Avoid sensitive work that doesn't use HTTPS (rare, but legacy systems exist)
General Hygiene
- Keep OS and browser up to date — this matters more than a VPN
- Use a password manager — protects against phishing even on compromised networks
- Enable 2FA on important accounts — steals-session attacks become useless
- Use encrypted DNS (DoH/DoT) in your OS or browser
The Phone Hotspot Alternative
If you have unlimited cellular data and a recent phone, your hotspot is often a better choice than public Wi-Fi:
- Cellular traffic is encrypted and not shared with nearby strangers
- 5G speeds often match or exceed public Wi-Fi
- No captive portals to navigate
- No evil-twin risk
Trade-off: cellular data usage, battery drain, and coverage uncertainty. For sensitive work in a coffee shop, tethering can be worth it.
Is Public Wi-Fi Safe for Banking?
Yes, in practice, as long as:
- You're using the bank's official app or the HTTPS website with padlock
- The domain is correct — look at the URL carefully
- Your device is patched and not already compromised
- You have 2FA on the account
The threat model where "public Wi-Fi can steal your bank info" was largely addressed by HTTPS and app security a decade ago. Modern banking apps are specifically designed to resist hostile networks.
Frequently Asked Questions
Is public Wi-Fi still dangerous in 2026?
Not as dangerous as it used to be. HTTPS now encrypts nearly all web traffic end-to-end, which addresses most classic public Wi-Fi attacks. Remaining risks include evil-twin networks, rogue captive portals, and unpatched devices. Use HTTPS, keep software updated, watch for certificate warnings, and you're mostly safe.
Do I need a VPN on public Wi-Fi?
For most browsing, no — HTTPS already provides strong protection. A VPN adds genuine value if you want to hide which domains you visit from the network operator, access work resources, or you don't trust the local network. A bad/free VPN is worse than no VPN; pick reputable providers only.
Is it safe to check email or bank accounts on hotel Wi-Fi?
Yes, on official apps or HTTPS sites with the padlock icon and correct domain. The bigger risks are phishing, malware, and evil-twin networks — not the Wi-Fi itself. Enable 2FA, use a password manager, and pay attention to certificate warnings.