Public Wi-Fi is safe enough for reading the news and dangerous enough that you should not log into your bank on it without precautions. The reason for both halves: HTTPS now encrypts the content of nearly every site, so the person at the next table cannot read your messages or steal your password; but the network still sees which sites you visit, your device still announces itself, and a fake hotspot with the café's name takes minutes to set up. What follows is what is actually visible, the four real risks, and six rules that take care of most of it.

What the network can see

Everyone on the same network shares the same path to the router, and the network's owner sees everything that passes through it. Visible:

  • Which domains you connect to. DNS queries and the server name in the TLS handshake (SNI) are usually sent in plain text.
  • When and how much. Timing and volume of every connection. A video call looks different from email.
  • Your device: its name, manufacturer, and the background requests apps make.
  • Anything unencrypted: old apps, some smart devices, and the occasional site still on plain HTTP.

Not visible, on HTTPS sites: page content, forms, passwords, messages. This part works, and it is why public Wi-Fi is no longer the disaster it was ten years ago.

Does HTTPS make it safe?

Mostly, with three gaps. DNS: the "where is this site" question is usually unencrypted, so the network keeps a list of everywhere you went, and a malicious network can answer with the wrong address. The captive portal: the "accept terms" page you see on connecting sometimes loads over plain HTTP, and what you type into it, phone number, email, room number, is unprotected. And apps: not every app uses HTTPS as strictly as a browser does.

The four real risks

Evil twin. Someone broadcasts a network called "Airport_Free_WiFi" from a laptop. Devices pick the strongest signal, you join, and your traffic passes through their machine. HTTPS still protects content, but DNS and the captive portal are theirs.

Auto-join. Your phone remembers network names and reconnects to any network with the same name, no questions asked. This is what the evil twin relies on.

Open sharing. File sharing, AirDrop set to Everyone, printer sharing, a media server: all of it stays on when you join a stranger's network, and anyone on that network can see your device and try.

Portal forms. Hotels ask for surname and room number, airports for a phone number. Where that data goes and how long it is kept is rarely stated.

Six rules before you connect

  1. Ask which network is real. One question to staff removes most evil twins. At airports, use the name on official signage.
  2. Turn off auto-join. On iPhone, tap the (i) next to the network and disable Auto-Join; on Android, open the network details and disable auto-connect.
  3. Clear the captive portal, then start working. Never enter card details or account passwords into a portal page. No café needs them.
  4. Turn off sharing. Set AirDrop to Contacts Only, mark the network as Public on Windows, disable file and printer sharing.
  5. Use mobile data for anything sensitive. The carrier link is encrypted and other subscribers cannot see your traffic. Banking on mobile data, videos on Wi-Fi.
  6. Turn on the VPN before you do anything else. Why is the next section.

After connecting, the Privacy Checker shows what your device reveals to websites on its own, and What Is My IP shows the address you are currently using.

What a VPN solves on public Wi-Fi

With the VPN on, everything your device sends, including DNS, goes through an encrypted tunnel to the VPN server. The café's router and the person running an evil twin see one encrypted connection to one address: no domain list, no DNS, no app traffic. That closes every gap HTTPS leaves.

What it does not do: protect what you typed into the captive portal (that happens before the tunnel), close the sharing services on your device, or cover the seconds when the tunnel drops. For the last one, the VPN's kill switch must be on; it blocks traffic until the tunnel is back rather than letting it fall to the open network. What the network sees with and without a tunnel is laid out in what can my ISP see, and the same logic applies to a café.

In short: on public Wi-Fi, HTTPS protects the content and a VPN protects everything else, which is where you went and when. Together they make a hotel or airport network about as private as your own.

404 VPN uses VLESS and WireGuard, keeps DNS inside the tunnel, blocks traffic during reconnects with a kill switch, and can connect automatically on untrusted Wi-Fi. Details on the security page; set it up before your next trip.