Internet Tracking, cookies and what follows you around
Public wifi in 2026: what is still risky and what is not
How the risk on cafe and airport wifi has changed, the attacks that still work, and the two settings that matter more than any VPN subscription.
The short answer
- Public wifi is far safer than it was, because near universal HTTPS removed the old attack where a stranger nearby read your passwords and cookies out of the air.
- What remains is fake networks copying a familiar name, fake sign in portals, sharing features left switched on, and people reading your screen.
- Turning off automatic joining for open networks and forgetting the network afterwards defeats the most common remaining attack for free.
- A VPN hides which sites you visit from the network operator, but it cannot stop phishing, malware or a fake portal you type a password into.
- For a bank transfer, a password reset or a one time code, mobile data or your own phone hotspot is simpler and safer than any setting on public wifi.
- Never install an app, profile or certificate that a wifi network asks for, because that is the one step that lets someone read encrypted traffic.
The thing you were warned about, a stranger at the next table pulling your passwords out of the air, is mostly over. Almost everything you load now travels over HTTPS, which encrypts the contents between your device and the server before the wifi ever touches it. Someone watching an open network can still see which servers you talk to, but not what you send them. What is left is a different list: fake networks that copy a familiar name, sign in pages that are not really sign in pages, sharing features left switched on, and someone reading your screen. Those are fixed by four or five settings and by reaching for mobile data when a task matters, not by buying a subscription.
Why the old advice is out of date
The warnings date from a time when most of the web ran over plain HTTP. On an open network every device within range could read every packet, and a browser add-on could pick session cookies out of the air and walk into somebody else's logged in email. That attack worked, it took no skill, and the advice to stay off public wifi was correct. Then the web encrypted itself. Certificates became free and automatic, browsers began marking plain HTTP pages as not secure, and sites started instructing browsers to refuse an unencrypted connection at all. A network operator, honest or not, now sees only the outside of your traffic.
Here is what that outside still reveals: the addresses of the servers you connect to, usually the name of the site in the opening handshake, your DNS lookups unless you have encrypted DNS switched on, and the size and timing of what flows back and forth. The practical translation is that an observer can tell you opened your bank's app. They cannot see your balance, your password or your messages. The two halves of that mechanism are covered in what the padlock actually proves and how DNS decides where you land.
The attacks that still work
Four of them, roughly in order of how often they turn up.
The evil twin. Anyone can broadcast a network using the name of the cafe, the hotel or the airport. Your phone remembers names, not networks, so a device set to join automatically will attach to whichever one is strongest and say nothing. The attacker is now your router. They still cannot read your encrypted traffic, but they can log every server you reach, answer your DNS queries with addresses of their own, quietly block the encrypted version of a site in the hope you will retype the address without the s, and put a very convincing page in front of you.
The fake captive portal. The sign in page a hotel or airport pushes at you has to work over plain HTTP, because you have no internet access yet. That trains people to accept a page that looks broken and type things into it anyway. A hostile portal asks for an email address and a password, on the reasonable bet that the password is reused elsewhere. Or a card number for premium speed. Or, worst of all, it asks you to install a profile or a certificate before you can continue. That last one is the only realistic way to break HTTPS on a current phone, and it requires your explicit permission. The reflexes described in how phishing gets past careful people are exactly the ones you need here.
Your own device answering the room. Open networks often have no isolation between clients, so every other guest sits on the same segment as you. File sharing, network discovery, a media server or a drop style transfer feature set to accept from everyone are all reachable. Nothing clever is required; your device is simply replying to whoever asks.
Shoulder surfing and the walk away. Unglamorous, and still the most common way anything is actually lost in a public place. Somebody reads the code you type, or your laptop sits alone at the table while you collect your coffee. A short lock timeout plus face or fingerprint unlock fixes both, because a screen lock only helps if it triggers quickly and you do not resent unlocking it forty times a day.
| Risk | Before HTTPS was everywhere | Today | What actually fixes it |
|---|---|---|---|
| Password read in transit | Real and trivial | Essentially gone on any page that loads with a padlock | HTTPS, already on |
| Session cookie stolen from the air | Real, and famously easy | Gone for the same reason | HTTPS, already on |
| Which sites you visit | Fully visible | Still visible: addresses and usually site names | A VPN, or encrypted DNS |
| Evil twin network | Real | Still real, and the hardware is cheap | Turn off auto join, forget networks, use a VPN |
| Fake sign in portal | Real | Still real, and better designed than it used to be | Never type a password or card into a portal |
| Other guests reaching your device | Real | Still real wherever client isolation is off | Mark the network public, turn sharing off |
| Someone reading your screen | Real | Still real, and unaffected by any software | Lock timeout, seat position, privacy filter |
What a VPN does and does not do here
A VPN wraps everything your device sends in a second layer of encryption and delivers it to a server run by the VPN provider, which then talks to the internet for you. On a hostile network that is genuinely useful: the operator sees one encrypted connection to one address and learns nothing else, and your DNS queries travel inside the tunnel so a malicious router cannot answer them.
What it does not do is the longer list. It does not stop you typing your password into a convincing fake page. It does not stop a download that contains malware. It does not make you anonymous, because you have moved the record of everywhere you go from the cafe to a company with servers, logs and a legal jurisdiction. And it is worth nothing against a certificate you agreed to install yourself. The full set of trade offs is in what a VPN can and cannot do.
The honest summary: on an ordinary cafe network in a country with an open internet, a VPN is a modest privacy improvement, mostly against the network operator building a profile of the sites you use. It matters much more when the network belongs to someone you have reason to distrust, when the connection is censored or heavily monitored, or when your employer requires one to reach internal systems.
The settings that matter more than any subscription
All of these live in the wifi or network section of your settings, and all of them are free.
- Turn off automatic joining for open networks, and turn on the option that asks before joining anything new. This is the single change that defeats the evil twin, because the attack depends on your device connecting without asking you.
- Forget the network when you leave. A remembered name is precisely what gets impersonated three cities later. Public wifi should be a one time relationship.
- Tell the operating system the network is public rather than home or trusted. On Windows that one choice disables discovery and sharing. On a Mac or a phone the equivalent is switching file sharing off and setting any drop style receiving to contacts only.
- Leave the private or randomized wifi address setting alone if it is on, which it is by default on current phones. It gives each network a different hardware address, which stops venues stitching your visits together over time.
- Install operating system updates promptly, since several of the remaining attacks depend on bugs that were patched a while ago. Which updates to install now and which can wait sorts out the priorities.
- Keep a second factor on your important accounts, so that a password captured by a fake portal is not enough on its own to sign in.
When to use mobile data instead
Mobile data removes the local network from the picture entirely. A cellular connection is encrypted between your phone and the tower by design, and nobody in the room is on it with you.
The tasks worth switching for are short ones where the stakes are high: moving money, resetting a password, receiving a one time code, or signing into something for the first time from a new device. These use a few megabytes at most, so the cost argument rarely holds. On a laptop, turning on the phone's hotspot for two minutes does the same job. Leave streaming, maps and video calls on the venue's wifi, since those eat an allowance and risk very little if the operator watches.
The setup worth doing today
Open your wifi settings and delete the saved networks you will never use again, starting with hotels and airports. Turn off auto join for open networks. Set the screen to lock after a minute or two, and confirm face or fingerprint unlock is on so the short timeout is not annoying. Check that file sharing and drop style receiving are off or limited to contacts. Then answer the VPN question honestly. If you travel to places with restricted internet, or you often work on networks you do not control, choose a provider with a published independent audit and a clear no logging policy. If you mostly sit in the same three cafes at home, spend the effort on the settings above instead. They protect you on every network, whether or not you remembered to switch anything on.
Common questions
Is it safe to do online banking on public wifi?
Technically yes, because your banking app and your bank's website refuse to connect without encryption, and that encryption is not broken by a shared network. The practical advice is still to use mobile data for it. A transfer takes seconds and a few kilobytes, and switching removes any question about who runs the network and what their sign in page was really asking for.
Do I need a VPN on hotel wifi?
It helps more on hotel and conference networks than on most others, because those networks are shared with hundreds of strangers, often run by a contractor, and commonly inject their own pages into your browsing. A VPN stops all of that. It will not protect you from the hotel portal itself, so treat any page asking for a password, a room number and a card with suspicion.
Can other people on the same wifi see what I am doing?
They can see which servers you connect to and roughly how much data you move, which often reveals which sites and apps you are using. They cannot see the contents: your messages, passwords, page text and files stay encrypted. On a network without client isolation they may also see your device itself, which is why turning off file sharing matters more than it sounds.
Is a wifi network with a password safer than an open one?
A little, and less than people assume. A shared password printed on a menu is known to everyone in the building, so it does not keep other customers out. What it does add on modern equipment is individual encryption between each device and the access point, which makes casual snooping harder. It does nothing at all against an evil twin broadcasting the same name and password.
How do I tell a fake wifi network from the real one?
Often you cannot, which is why the defense is behavioral rather than visual. Ask the staff for the exact network name rather than guessing from the list, be suspicious of two networks with almost the same name, and never enter a password, card number or personal details into a wifi sign in page. If a network you have never used before already connected automatically, disconnect and forget it.