Free Wi-Fi is everywhere: coffee shops, airports, hotels, trains, libraries and shopping centres. It is convenient, and most of the time nothing bad happens. But a public network is shared with strangers and run by people you don't know, so a few simple habits are worth building.

This guide explains the real risks in plain terms, what already protects you, and a short checklist you can follow every time you connect.

What is different about public Wi-Fi

At home, you control the router, you set the password and you know who is connected. On public Wi-Fi, none of that is true:

  • You don't know who runs the network or how carefully it is configured and updated.
  • You share it with everyone nearby. On a poorly configured network, other users may be able to see your device or try to connect to it.
  • Many public networks are open, meaning no password at all. On a traditional open network, traffic between your device and the access point isn't encrypted by the Wi-Fi itself.
  • Anyone can create a network with a convincing name, such as "Airport_Free_WiFi", and wait for people to join.

What HTTPS already protects

The good news is that most websites and apps now use HTTPS, which encrypts the connection between your device and the site. The EFF's Surveillance Self-Defense guide notes that because most web traffic is now encrypted with HTTPS, using a VPN on public Wi-Fi isn't as necessary for everyone as it used to be.

HTTPS protects the content: the pages you open on a site, what you type into forms, your messages and passwords. Sites can also use HTTP Strict Transport Security (HSTS), defined in RFC 6797, to tell your browser to always use a secure connection to them, which makes it harder for someone to downgrade you to an insecure one.

What HTTPS doesn't hide is the metadata. The EFF explains that people along the path can usually still see the domain names you visit and when you visit them, as well as the sizes of pages and files. On public Wi-Fi, that "path" includes the network operator and potentially other users if the network is badly set up.

The real risks

Fake hotspots

The most practical risk is joining the wrong network. A fake hotspot with a believable name lets its operator see your metadata, show you fake login pages, or try to push you towards malicious downloads. Always confirm the exact network name with staff or official signs.

Fake captive portals

Many public networks show a sign-in page before you can browse. Attackers can imitate these pages to collect email addresses, passwords or card details. A legitimate café portal rarely needs more than accepting terms or entering a code from your receipt.

Unencrypted apps and services

Not every app is careful. Older apps, smart devices and some internal services may still send information without encryption. On a shared network that traffic can be exposed.

Your device being visible

If file sharing or network discovery is turned on, other people on the same network may see your device. That is fine at home but not in an airport lounge.

Shoulder surfing

Not every risk is technical. Someone looking over your shoulder at a password or a card number is a classic problem in busy places.

Newer Wi-Fi security helps, where it's available

Wi-Fi itself is improving. The Wi-Fi Alliance describes WPA3 as the current generation of Wi-Fi security, and Wi-Fi Enhanced Open as a way to give users unauthenticated data encryption on open networks, an improvement over traditional open networks with no protections. Support depends on both the network and your device, so you can't count on it everywhere yet.

Your public Wi-Fi checklist

Before you connect

  • Confirm the network name with staff or a printed sign. Be wary of near-duplicates.
  • Update your device and apps. The NCSC's top tips include installing the latest software and app updates, because updates fix security problems attackers rely on.
  • Turn off automatic joining for open networks, so your phone doesn't silently connect to a network that just happens to share a common name.
  • Turn off file sharing and network discovery. On Windows, choose the "Public" network profile.

While you are connected

  • Check for HTTPS before typing passwords or payment details. Your browser shows a padlock or similar indicator.
  • Be suspicious of sign-in pages that ask for more than they should, such as passwords for other services.
  • Avoid installing software or updates that a network page prompts you to download.
  • Use two-step verification on important accounts. The NCSC recommends turning on 2-step verification (2SV), so a stolen password alone isn't enough.
  • Use a strong, separate password for your email, another NCSC tip, because your email can be used to reset your other accounts.

When you're done

  • Forget the network in your Wi-Fi settings if you won't be back.
  • Sign out of accounts on any shared or public computer.

Where a VPN helps on public Wi-Fi

A VPN doesn't replace the habits above, but it adds a useful layer on networks you don't trust. With a VPN on:

  • The Wi-Fi operator and other users see only that you are connected to a VPN server, not which sites you visit.
  • Apps that don't encrypt properly are protected between your device and the VPN server.
  • Websites see the VPN server's IP address instead of the public address of the café or hotel.

The EFF puts it this way: if you need to use a public network you don't trust, and you have a VPN you trust, a VPN may be useful. Keep the VPN app updated, as you would any security software.

A kill switch matters on public Wi-Fi in particular. Networks drop and reconnect often, and a kill switch keeps traffic from leaving your device unprotected in the gap. On Android, VPN apps can use the system's Always-on VPN setting together with "Block connections without VPN", which you'll find under your VPN settings as described in Android Help.

Using VPNRice on public networks

VPNRice is designed for exactly this kind of everyday situation:

  • One tap to connect. The app picks a server automatically from servers in 39 countries.
  • Kill switch. Available in the apps; on Android it relies on Android's Always-on VPN setting.
  • Ad and tracker blocking. Ad and tracker blocking in the apps, where available for your plan, reduces the trackers that follow you between sites.
  • Automatic protocol choice. Public Wi-Fi quality varies a lot. If a connection doesn't work well, Auto mode can switch to another protocol (on Android and Windows this includes the TLS-based RiceGuardX).
  • Apps for your devices. Android, iPhone and iPad, Windows, and Android TV, plus Chrome and Firefox extensions that route your browser's traffic through VPNRice servers. The extensions don't add encryption themselves (sites you open over HTTPS stay encrypted end to end), so on public Wi-Fi turn on the full VPNRice app, which encrypts all of your device's traffic.

After connecting, you can confirm that your traffic is going through VPNRice with our What is my IP tool, which shows a Safe or Exposed status, and run the WebRTC leak test to check your browser.

The short version

Public Wi-Fi is not dangerous by default, but it is shared and unknown. Confirm the network name, keep your device updated, rely on HTTPS, turn on two-step verification and switch off sharing. Add a VPN you trust for networks you don't.

Ready for your next café visit? Download VPNRice and turn it on before you join the network.