Myth: A Stranger on the Same WiFi Can Read Your Passwords
This was true, roughly a decade ago. Back when most websites still ran on plain HTTP, anyone sharing a coffee shop network with you could read your traffic in cleartext with free, widely available tools: passwords, messages, session cookies, all of it flying by in the open. That version of the story is where most public WiFi warnings still come from, and it is why the advice feels frozen in 2012.
Today, HTTPS covers the overwhelming majority of web traffic, including essentially every login page you will encounter. On an encrypted connection, someone sharing your network can see which domains you are visiting, because that metadata is not hidden, but they cannot read what you send or receive inside that connection. No passwords, no message contents, no card numbers leak in plaintext anymore on a properly configured HTTPS site. The old horror story mostly does not work as described anymore. Mostly, because the real risk moved somewhere else.
Myth: The Network Itself Is the Danger
The actual modern danger is not the WiFi signal, it is what gets impersonated on top of it.
Evil Twin Hotspots
The most practical attack against public WiFi in 2026 does not touch encryption at all. An attacker simply broadcasts a network named "Airport_Free_WiFi" or clones a cafe's real network name using a stronger signal than the legitimate router. Your device connects to their hardware, believing it to be the real network. They still cannot break HTTPS traffic passing through them, but they now control DNS resolution for your device, can serve a fake captive portal, and can redirect poorly configured connections toward lookalike sites.
Fake Captive Portals
That login screen demanding an email address, a password, or a social media login before granting internet access is a near perfect phishing surface. A legitimate portal asks you to accept terms of service. A hostile one harvests real credentials by asking for a real password. Never enter an account password you use anywhere else into a WiFi login page.
The Small Amount That Still Leaks
Old apps with broken TLS configurations, some cheap IoT gadgets, DNS queries on networks lacking encrypted DNS, and the rare remaining plain HTTP site all still leak content in plaintext. Domain level metadata, which sites you contacted and roughly when, leaks broadly on every public network regardless of HTTPS.
Direct Attacks on Your Device
Sharing a local network lets an attacker probe your device for open ports and exposed services: file sharing left enabled, an outdated app with a known network facing vulnerability. This is exactly why your operating system asks whether a new network is "public" or "private." The public setting closes those doors by disabling discovery and sharing. Answer that prompt honestly every time.
The honest rule for public WiFi in 2026: the network itself rarely breaks your security anymore. What breaks it is the fake network, the fake portal, and the fake login page sitting behind it. The WiFi threat quietly became a phishing threat wearing a WiFi costume.
What Actually Still Protects You
- Look for HTTPS on every page, without exception. If a login page's address bar shows "Not secure," stop immediately. No exceptions on a network you do not control.
- Confirm the network name with staff directly. "CafeName_Guest" and "CafeName Free" are not the same network, and an attacker's clone frequently has the stronger signal in the room.
- Mark unfamiliar networks as Public when your device asks, which disables file sharing and network discovery automatically.
- Never type an account password into a captive portal. Legitimate portals never need one.
- Keep the operating system and browser updated. Direct device attacks over a shared LAN target vulnerabilities that patches already closed months earlier.
- Reach for your phone's hotspot before anything financial. Cellular data removes the shared network problem entirely, and tethering takes seconds when the stakes are actually high.
- Turn off auto join for open networks in your device settings. Phones happily reconnect to anything sharing a name they remember, which is precisely what an evil twin network exploits.
Where Two Factor Authentication Fits Into This Picture
Public networks raise the odds of landing on a phishing page through evil twin DNS tricks or a hostile captive portal redirect, more than they raise the odds of raw traffic snooping. Two factor authentication is the safety net for exactly that moment: a password harvested through a fake page becomes a dead end without the second factor behind it. If some of your accounts still lack 2FA, our 2FA beginner guide is the place to start. TOTP apps generate codes offline too, so they work fine even on a hostile or flaky network; try one at our free 2FA code generator. Passkeys go a step further still, refusing to authenticate to a lookalike domain in the first place, which makes the fake page game essentially unwinnable. Details in our passkey guide.
So Do You Actually Need a VPN for Coffee Shop WiFi?
Less than most VPN advertising claims, honestly. HTTPS already encrypts the content of your traffic before it ever leaves your device. What a reputable VPN genuinely adds on public WiFi: it hides which domains you are visiting from the local network operator, covers the rare app still shipping weak encryption, and neutralizes DNS manipulation attempted by a hostile hotspot. What it does not do: stop phishing pages, stop malware, or stop a fake captive portal, which are the attacks that actually matter today. Treat a VPN as a privacy layer against the network operator, not as a force field against every threat on the network.
Frequently Asked Questions
Can someone sitting near me on public WiFi actually see my password as I type it?
On an HTTPS site, effectively every login page today, no. The encryption is applied before anything leaves your device. The realistic danger is being steered toward a fake login page and typing your real password there yourself. Check the domain in the address bar carefully; our phishing guide shows exactly what to look for.
Is hotel WiFi meaningfully safer than a coffee shop's network?
Structurally they are nearly identical: a shared network, a captive portal, and an operator you do not really know. Hotel networks do get targeted somewhat more often, since guest lists sometimes include higher value targets. The same rules apply either way, and tethering for anything financial removes the question entirely.
Is it safe to check my bank balance on public WiFi?
Through the bank's official app or its genuine HTTPS website, the connection itself holds up fine. The real risks sit around it: a fake network or a lookalike page. Typing the bank's address yourself, or using its official app, combined with 2FA on the account, covers the realistic danger. If you are ever unsure, thirty seconds of switching to your phone's hotspot ends the debate.
What about public USB charging stations, is that a separate risk?
Different attack entirely, sometimes called juice jacking, and largely theoretical against modern phones, which prompt before trusting a new data connection over USB. Selecting "charge only" when asked closes the question. Carrying a small wall adapter avoids the scenario altogether.
If there is one single habit worth keeping, what is it?
Treat every login page reached over public WiFi with a moment of suspicion, and verify the domain before typing anything into it. The network itself can inconvenience you at worst. Only a fake page in front of it can actually rob you, and only if you hand it your credentials directly.
