# Staying Safe on Public Wi-Fi Source: https://urbanx.co.za/knowledge-hub/digital-safety-privacy-account-protection/staying-safe-public-wifi **Answer:** Modern websites and apps usually protect data in transit with HTTPS, so public Wi-Fi is not automatically unsafe. The remaining risks include joining an impersonated hotspot, ignoring certificate warnings, exposing a poorly secured device, entering data into a deceptive captive portal and using compromised accounts. Verify the network, keep software updated, limit sharing, use secure websites and prefer mobile data for unusually sensitive activity when practical. Part of [Digital Safety, Privacy & Account Protection](https://urbanx.co.za/knowledge-hub/digital-safety-privacy-account-protection) · 11 min read · by UrbanX Knowledge Hub **Last reviewed: 26 August 2026 · 11 min read** ### What public Wi-Fi can and cannot reveal On a correctly secured HTTPS connection, other people on the hotspot should not be able to read the encrypted page contents, passwords or form fields in transit. The browser’s address bar should show a secure connection and no certificate warning. Encryption does not make the whole situation private or trustworthy. Depending on the service and protocol, the hotspot operator may still observe connection metadata such as device presence, timing, volume and some destinations. The website or app still sees the activity it normally receives, and a deceptive website can misuse information even while its connection is encrypted. HTTPS protects a connection to a destination; it does not prove that the destination deserves your trust. ### The main risks #### A lookalike hotspot An attacker can create a network name similar to a café, hotel, airport or conference network. Joining it gives the operator control over the local connection and an opportunity to present a fake login page. #### A deceptive captive portal Legitimate hotspots often display a page for terms, room details or a voucher. A fake portal may request an email password, card PIN, one-time PIN or social-media sign-in that the venue does not need. #### Browser or certificate warnings A warning may indicate an interception attempt, a misconfigured portal or the wrong website. Do not bypass it for a sensitive service. Disconnect and use another connection. #### An exposed device File sharing, discovery services, old software and permissive firewall settings can make a laptop or phone more accessible on an untrusted local network. #### Existing account compromise Public Wi-Fi sometimes receives blame for activity caused by password reuse, phishing or a previously stolen session. Connection safety and account safety support each other but are not the same problem. ### Before connecting #### Confirm the correct network Ask the venue for the exact network name and sign-in method. A familiar-looking name is not enough. Avoid networks named to create urgency, such as “Free Fast WiFi”, when the venue cannot confirm them. #### Update first Install operating-system, browser and app security updates before travelling where possible. Turn on the device firewall and disable services that are not needed. #### Prepare account protection Use unique passwords and MFA or passkeys. Store recovery codes safely rather than in a public screenshot or unprotected note. #### Disable automatic joining Configure the device to ask before joining a new network. Automatic connection can attach to an old or impersonated network name without a deliberate choice. ### While connected #### Check the address and warning state Type important addresses or use the genuine app. Do not continue through a browser’s certificate or insecure-connection warning. A padlock or secure indicator means the connection is encrypted; still verify the domain and the purpose of the page. #### Share only what the portal needs A venue may reasonably ask for acceptance of terms, a voucher, surname or room number. It should not need the password for your email, bank or device account. Do not reuse an important password as a Wi-Fi registration password. #### Use the correct network profile Choose a public-network profile on a laptop when prompted. Turn off file, printer and media sharing unless specifically required. Avoid approving local-device discovery requests from unfamiliar apps. #### Consider mobile data for high-impact actions For banking changes, identity-document uploads, password-manager recovery or other unusually sensitive tasks, a personal mobile connection may reduce uncertainty about the local network. It does not protect against phishing, a compromised device or a deceptive service. #### Use an approved VPN when required An employer may require its managed VPN to reach work systems. Follow that policy and use the approved client. This article does not compare consumer VPNs or promise anonymity. A VPN transfers trust to the VPN service and cannot make a fake website legitimate. #### Keep physical control of the device Shoulder surfing and an unattended unlocked device can defeat careful network choices. Use a screen lock and avoid displaying one-time codes or recovery information in a crowded space. ### After leaving - Disconnect from the network. - Forget it if the device does not need to reconnect. - Re-enable settings changed for the visit only when appropriate. - Review unexpected login or MFA alerts. - If a suspicious portal received a password, change that password from a trusted connection and contain reuse. - If a certificate warning was bypassed during a sensitive session, inspect the relevant account directly. Forgetting the network reduces accidental future reconnection; it does not erase activity already performed. ### Public Wi-Fi myths #### “Anyone nearby can read everything I do” That overstates the risk for correctly implemented HTTPS connections. Encryption normally prevents people on the hotspot from reading the protected content in transit. #### “The padlock proves the business is real” No. It shows that the connection to that domain is encrypted. A fraudulent domain can also use HTTPS. #### “A VPN makes every website safe” No. It can protect traffic between the device and VPN service, but it does not validate a payment request, stop password reuse or undo malware on the device. #### “A password-protected hotspot is private” Not necessarily. A shared venue password controls access but does not make every participant trusted. ### If something suspicious happens Disconnect if: - the hotspot repeatedly asks for account secrets; - the browser shows certificate warnings; - pages redirect to unrelated domains; - unexpected software or profiles are requested; or - authentication prompts appear without an action you initiated. Record the network name and suspicious address without revisiting it. If credentials were entered, follow [What to Do After an Online Account Is Hacked](/knowledge-hub/digital-safety-privacy-account-protection/what-to-do-account-hacked). If payment data was submitted, contact the bank through its official fraud route. ### Sources - [FTC: Are Public Wi-Fi Networks Safe?](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know) - [Google Chrome Help: Check if a Site’s Connection Is Secure](https://support.google.com/chrome/answer/95617) - [CISA: Use Strong Passwords](https://www.cisa.gov/secure-our-world/use-strong-passwords) - [CISA: Turn On MFA](https://www.cisa.gov/secure-our-world/turn-mfa) - [RFC Editor: TLS 1.3](https://www.rfc-editor.org/info/rfc9846/) ### Related guides - [All Digital Safety, Privacy & Account Protection guides](/knowledge-hub/digital-safety-privacy-account-protection) - [HTTPS Explained: What It Protects and What It Does Not](/knowledge-hub/digital-safety-privacy-account-protection/https-what-it-protects) - [How to Check Whether a Website or Payment Link Is Legitimate](/knowledge-hub/digital-safety-privacy-account-protection/check-website-payment-link-legitimate) - [How Multi-Factor Authentication Protects Online Accounts](/knowledge-hub/digital-safety-privacy-account-protection/multi-factor-authentication-account-protection) ## Frequently Asked Questions **Is it safe to use banking apps on public Wi-Fi?** Reputable apps use encrypted connections, but a personal mobile connection can be a sensible lower-uncertainty choice for high-impact actions. Never ignore connection warnings or approve an unexpected authentication request. **Does HTTPS make public Wi-Fi completely private?** No. It protects the connection content in transit, but the hotspot may still see some metadata and the destination service still receives normal account and activity data. **Must I use a VPN on every public hotspot?** No single tool is mandatory for every ordinary session. Use an employer-approved VPN when policy requires it, and understand that a VPN does not prevent phishing or make a deceptive site genuine. **Should I turn off Bluetooth as well?** Disable unused radios and sharing features when practical, especially in crowded environments. Bluetooth risk is separate from the Wi-Fi connection itself. **Is a hotel room number safe to enter on a captive portal?** It may be part of the venue’s legitimate access process, but first confirm the network and portal with the venue. Do not supply unrelated account passwords or one-time PINs.