Is public Wi-Fi safe?

Safer than the standard warning suggests, but not for the reason most people think. Simple eavesdropping on a legitimate public network is far less useful to an attacker today than it was a decade ago, because nearly all sensitive web traffic is now encrypted by default. The real modern risk isn't someone silently watching a real network — it's the network itself being fake.

Why the old warning is mostly outdated

The classic public-Wi-Fi warning — "anyone on the network can see what you type" — described a web where most sites still sent data in plain HTTP. That web mostly doesn't exist anymore. HTTPS is now the default on the overwhelming majority of the sites people actually log into, which means the content of what you type is encrypted before it ever leaves your device, regardless of who else is on the same Wi-Fi network. Someone passively monitoring a legitimate public network today mostly sees which domains you're visiting, not what you're doing on them.

The real modern threat: the network itself isn't real

An evil twin attack sets up a rogue access point broadcasting the exact same name as a network people already expect and trust — an airport's free Wi-Fi, a café's guest network — often at a stronger signal so nearby devices prefer it automatically. Anyone who connects is routed through a fake captive portal login page designed to harvest whatever credentials they type in, before ever reaching the real internet.

This isn't a theoretical scenario. In 2024, Australian authorities arrested Michael Clapsis for running exactly this attack — a portable "Wi-Fi Pineapple" device broadcasting fake networks at airports in Perth, Melbourne, and Adelaide, and on domestic flights, luring passengers into fake login pages that captured their credentials. He was sentenced in November 2025 to seven years and four months in prison. Security researchers note this specific attack is still uncommon in the wild compared to phishing or malware — but the Clapsis case proves it's an active, currently-prosecuted crime, not just a lab demonstration.

Risks that don't require a fake network at all

A legitimate, correctly-named public network still puts you on the same local network as every other stranger connected to it. That's enough for a malicious device on the same network to attempt ARP spoofing (redirecting local traffic through itself) or DNS hijacking (quietly substituting a different address for the site you meant to visit) — no cloned SSID required, just shared physical proximity to other users you have no way to vet.

What actually protects you today

• Confirm the exact network name with staff before connecting — the single most effective check against an evil twin, since attackers rely on people connecting to whatever looks familiar without asking.
• Use a VPN for anything sensitive — it closes the eavesdropping gap on the local network entirely, though it won't stop you from typing a password into a convincing fake login page. See our guide on what to actually check before trusting a "no-logs" VPN if you're choosing one.
• Turn off auto-join for saved Wi-Fi networks — devices that automatically reconnect to remembered network names make it easier for a cloned SSID to connect silently in the background.
• Prefer your phone's mobile hotspot for anything sensitive when it's available — it removes both the evil-twin and shared-local-network risks at once.