How to Use Public Wi-Fi Safely on a Laptop or Phone

You are at an airport gate or a coffee shop with 30 minutes to spare and an email that has to go out, and the only connection is an open network called "Free_WiFi". You have heard it is risky, but nobody explains exactly how risky, or what you should actually do about it.

This guide explains how to use public Wi-Fi safely on a laptop or phone. It covers what the real threats are in 2026, a short checklist that takes two minutes to set up, the settings that matter on Windows, macOS, Android and iPhone, and why the usual "always use a VPN" advice is not the whole story.

What can go wrong on public Wi-Fi

The risks have changed a lot in the past ten years. Today, more than 90 percent of web pages load over HTTPS, which encrypts the content between your browser and the website. Someone on the same café network generally cannot read your passwords or messages on a properly secured site.

That does not make public networks harmless. The threats that remain are real, just different from what older articles describe:

• Fake hotspots. An attacker sets up a network with a believable name, such as "Airport_Free_WiFi" or the name of the café. Once you join, they can send you to fake login pages or try to intercept traffic that is not encrypted.
• Captive portal tricks. The sign in page that asks you to accept terms is a common place for phishing, asking for your email password or card details "to verify".
• Exposed devices. If file sharing or network discovery is turned on, other people on the network may see your laptop and any shared folders.
• Unencrypted apps. Most mainstream apps use encryption, but some older apps, smart devices and niche tools still send data in the clear.
• Metadata. Even with HTTPS, the network operator can usually see which sites you visit, though not what you do on them.

A two minute checklist to use public Wi-Fi safely

Run through this before you connect. After the first time, it becomes automatic.

1. Confirm the network name with staff. Ask for the exact name and password, or check a sign on the wall. Do not guess between two similar names.
2. Choose "Public" when your device asks. On Windows, set the network profile to Public. This turns off discovery and file sharing.
3. Never enter passwords on the sign in page. A real captive portal asks you to accept terms, maybe for a room number or an email address. It never needs your email password or bank details.
4. Check for HTTPS on any page where you log in. Look for the padlock and the correct domain. Our guide on checking whether a website is safe covers what the padlock does and does not prove.
5. Use your phone's hotspot for sensitive tasks. Online banking, payroll and anything involving card numbers are better done on mobile data.
6. Forget the network when you leave. Otherwise your device may reconnect automatically to any network with the same name later.

Settings to change on each device

These settings take about five minutes in total and protect you every time you travel.

Windows

Open Settings, then Network and internet, then Wi-Fi, select the network and set the profile to Public. Under Advanced sharing settings, turn off network discovery and file and printer sharing for public networks. Make sure Windows Firewall is on.

macOS

In System Settings, open Network, then Firewall, and switch it on. Under General, then Sharing, turn off file sharing, screen sharing and remote login if you do not use them.

Android and iPhone

Turn off auto join for public networks. On iPhone, open the network's details and switch off Auto Join. On Android, open the saved network and turn off auto connect. Keep Private Wi-Fi Address, or the randomised MAC option on Android, switched on, which makes your device harder to track across hotspots.

On every device, the single most effective setting is still keeping software up to date. Most attacks on public networks rely on old, unpatched flaws. If you put updates off, read why software updates matter and how to stop delaying them.

Is a VPN really necessary on public Wi-Fi?

Most consumer security advice says to always use a VPN on public Wi-Fi. I think that advice is overstated for most people, and it can even create false confidence.

A VPN encrypts traffic between your device and the VPN company's server. On a public network that hides which sites you visit from the café or the hotel, and it protects any rare unencrypted traffic. That is useful. But HTTPS already protects the content of nearly everything you do in a browser. A VPN will not stop you from typing your password into a phishing page, will not protect a device with an outdated operating system, and moves your trust from the café to the VPN provider.

Free VPN apps are the bigger problem. Several have been caught logging and selling user data, which is the opposite of what people install them for. A paid, reputable service at around $3 to $10 a month is reasonable if you travel often or work with confidential client data. For someone checking email and browsing news at a café twice a month, the checklist above and your phone's hotspot cover most of the risk.

If your employer provides a VPN, use it. Company VPNs also protect access to internal systems, which is a different job.

What to do if you think something went wrong

Maybe you entered a password on a sign in page and realised later it looked odd. Act quickly:

1. Disconnect from the network and switch to mobile data.
2. Change the password you entered, starting with your email account, from a trusted connection.
3. Turn on two-factor authentication for that account if it is not already on.
4. Check recent sign in activity in your account settings and sign out of sessions you do not recognise.
5. If you entered card details, call your bank and ask them to block the card.

These steps are part of a broader set of habits worth building. See the handful of security habits that matter most for the rest.

Frequently asked questions

Can someone see what I am doing on public Wi-Fi?

On sites that use HTTPS, other people on the network cannot see the pages you read or the details you type. The network operator can usually see which domains you visit. Traffic from apps or sites without encryption can be seen, which is why HTTPS matters.

Is it safe to do online banking on public Wi-Fi?

It is technically protected by encryption, but it is better to avoid it. A fake hotspot or phishing page is the bigger risk. Use your phone's mobile data or personal hotspot for banking when you are out.

Is hotel Wi-Fi safer than café Wi-Fi?

Not by much. Hotel networks often require a room number and surname, but every guest shares the same network. Treat hotel Wi-Fi as public, set your device to the public profile and use mobile data for sensitive tasks.