Public WiFi Security: How to Stay Safe on Open Networks

The Hidden Danger of Free WiFi

Coffee shops, airports, hotels, libraries, and shopping malls all offer free WiFi. It is convenient, ubiquitous, and almost everyone uses it without a second thought. But public WiFi networks are among the most dangerous environments for your digital security.

Unlike your home network, public WiFi is shared by dozens or hundreds of strangers. The network operator may have minimal security configurations. And anyone on the same network — including attackers — can potentially intercept your traffic.

According to a 2025 report by Coro Security, 40% of public WiFi networks have no encryption, and 25% of public WiFi users have had their data compromised while connected. The convenience of free WiFi comes at a real cost to your privacy and security.

This article explains the specific threats you face on public WiFi, how those threats work, and the practical steps you can take to protect yourself.

---

The Risks of Public WiFi

Why public WiFi is inherently insecure

Public WiFi networks have several characteristics that make them attractive targets for attackers:

1. Open (unencrypted) networks. Many public WiFi networks do not require a password, meaning anyone can connect. On an open network, all traffic is transmitted in plaintext unless encrypted by the application (like HTTPS).

2. Shared environment. Every device on the network can potentially see other devices’ traffic. This is by design — WiFi was built for convenience, not security.

3. Weak or default credentials. The WiFi password (if one exists) is shared with every user. It may be posted on a wall, given to every customer, or set to a default value.

4. Minimal network monitoring. Coffee shops and hotels are not cybersecurity companies. Their networks may have no intrusion detection, no traffic monitoring, and no protection against malicious users.

5. No device isolation. Without proper configuration, devices on the same network can communicate directly, enabling attacks between devices.

---

Common Public WiFi Attacks

Man-in-the-Middle (MITM) Attacks

A man-in-the-middle attack occurs when an attacker positions themselves between your device and the internet, intercepting all traffic passing between them. On a public WiFi network, this is relatively straightforward because:

1. The attacker connects to the same open network
2. They use techniques like ARP spoofing or DNS spoofing to redirect traffic through their device
3. They can read, modify, or record all unencrypted traffic

What the attacker can see:

• Unencrypted HTTP websites you visit
• Form data submitted over HTTP (usernames, passwords, messages)
• DNS queries (which websites you are looking up)
• File transfers over unencrypted connections
• Session cookies (if transmitted over HTTP)

What the attacker cannot see (if properly encrypted):

• HTTPS website content (the encryption prevents reading)
• VPN traffic (encrypted end-to-end)
• End-to-end encrypted messages (Signal, WhatsApp)

Evil Twin Attacks

An evil twin attack occurs when an attacker creates a fake WiFi network that mimics a legitimate one. For example:

1. The coffee shop offers a network called “CoffeeShop_Free_WiFi”
2. The attacker creates a network called “CoffeeShop_Free_WiFi” (or “CoffeeShop_Guest”)
3. You connect to the attacker’s network, thinking it is legitimate
4. All your traffic passes through the attacker’s device
5. The attacker can intercept everything, inject malware, or redirect you to phishing sites

Evil twin attacks are particularly dangerous because there is no way to tell the difference between a legitimate network and an attacker’s network by looking at the network name.

Packet sniffing

On an open WiFi network, all traffic is broadcast over the air. Using freely available tools like Wireshark, anyone on the network can capture and analyze these packets. While encrypted traffic (HTTPS, VPN) prevents reading the content, packet sniffing can reveal:

• Which websites you visit (even if the content is encrypted)
• The timing and frequency of your requests
• DNS queries showing your browsing intentions
• Unencrypted credentials or personal information

Session hijacking

If you log into a website over HTTP (not HTTPS), the session cookie that identifies you is transmitted in plaintext. An attacker on the same network can capture this cookie and use it to impersonate you on that website — without needing your password.

DNS spoofing

An attacker can intercept your DNS queries and provide false responses, redirecting you to phishing websites even when you type the correct URL. This is particularly effective on networks where DNS-over-HTTPS is not configured.

---

Threat Matrix: Public WiFi Risks

Threat	Difficulty to Execute	Data at Risk	Affected By HTTPS	Mitigated by VPN
Man-in-the-Middle	Moderate	All traffic	Partially	Yes
Evil Twin	Easy	All traffic	Partially	Yes
Packet Sniffing	Easy	Metadata, unencrypted content	Partially	Yes
Session Hijacking	Moderate	Session tokens, account access	Yes (if HTTPS)	Yes
DNS Spoofing	Moderate	Browsing destinations, credentials	No (if DNS not encrypted)	Yes
Credential Harvesting	Easy	Usernames, passwords	Yes (if HTTPS)	Yes
Malware Injection	Moderate	Device integrity	Partially	Partially
Ad Tracking	Easy	Browsing habits, location	No	Partially

---

How to Protect Yourself on Public WiFi

The essential: Use a VPN

A Virtual Private Network (VPN) is the single most effective protection against public WiFi threats. A VPN encrypts all your traffic between your device and the VPN server, creating a secure tunnel that attackers cannot penetrate.

What a VPN protects against:

• Man-in-the-middle attacks (encrypted tunnel prevents interception)
• Packet sniffing (encrypted content is unreadable)
• DNS spoofing (DNS queries go through the encrypted tunnel)
• Evil twin attacks (encrypted tunnel renders the fake network useless)
• Session hijacking (cookies are transmitted inside the encrypted tunnel)

What a VPN does NOT protect against:

• Phishing attacks (you can still be tricked into entering credentials on fake websites)
• Malware downloads (malware is downloaded through the encrypted tunnel)
• Physical device theft
• Malicious WiFi login portals

Choosing a VPN for public WiFi

When selecting a VPN for use on public networks, look for:

• No-logs policy independently audited (essential — a VPN that logs your data defeats the purpose)
• Kill switch that blocks traffic if the VPN connection drops (prevents accidental exposure)
• Strong encryption (AES-256, WireGuard or OpenVPN protocol)
• Automatic connection on untrusted networks
• Trusted provider with a track record and transparent ownership

Avoid free VPN services on public WiFi — they often monetize by selling your browsing data, which is the opposite of what you need.

Always verify HTTPS

Even with a VPN, verify that websites use HTTPS. Look for:

• The padlock icon in the address bar
• The URL starts with https:// (not http://)
• Click the padlock to view the certificate details

HTTPS provides end-to-end encryption between your browser and the website, adding a second layer of protection beyond your VPN.

Disable auto-connect to WiFi

Configure your device to never automatically connect to open WiFi networks. This prevents your device from connecting to an evil twin or untrusted network without your knowledge.

On iOS: Settings → Wi-Fi → Ask to Join Networks → ON On Android: Settings → Network & Internet → Wi-Fi → Wi-Fi Preferences → Connect to open networks → OFF On Windows: Settings → Network & Internet → Wi-Fi → Manage known networks → select network → Properties → Connect automatically → OFF On macOS: System Settings → Wi-Fi → Ask to join networks → ON

Forget networks after use

After using a public WiFi network, tell your device to forget it. This prevents your device from automatically connecting to the same network (or an evil twin with the same name) in the future.

Disable file sharing and AirDrop

On public networks, ensure that file sharing, AirDrop, and other local sharing features are disabled. These features can be exploited by other users on the same network.

On macOS: System Settings → General → AirDrop → “No One” On Windows: Disable network discovery and file sharing in Network and Sharing Center

Use your mobile hotspot instead

If you have a mobile data plan, using your phone as a personal hotspot is often safer than using public WiFi. Your mobile data connection is encrypted and not shared with strangers. Enable your phone’s hotspot feature and connect your laptop to it.

---

Safe Practices for Specific Scenarios

Coffee shops and restaurants

• Use a VPN if connected to their WiFi
• Avoid accessing sensitive accounts (banking, email)
• If possible, use your phone’s mobile data instead
• Disable auto-reconnect after leaving

Hotels

• Hotel WiFi is often shared across many rooms and business centers
• Use a VPN for all traffic
• Verify the network name with the front desk (to avoid evil twins)
• Consider using the ethernet port in your room (wired connections are harder to intercept)

Airports

• Airport WiFi often requires a portal login, but this does not make it secure
• Use a VPN for all traffic
• Be extremely cautious about evil twin networks with names similar to the airport’s official network
• Avoid logging into sensitive accounts on airport WiFi

Libraries and public buildings

• These networks are often unmonitored
• Use a VPN and verify HTTPS on all sites
• Remember that public computers on these networks may have keyloggers

---

Public WiFi Safety Checklist

Before connecting to any public WiFi network, run through this checklist:

Step	Action	Priority
1	VPN is installed and ready to connect	Critical
2	Auto-connect to open networks is disabled	High
3	File sharing and AirDrop are disabled	High
4	Firewall is enabled	High
5	Device is updated (OS, browser, apps)	High
6	Sensitive accounts have 2FA enabled	Critical
7	HTTPS-only mode is enabled in browser	High
8	Network name is verified with venue staff	Medium
9	Mobile data backup is available	Medium
10	Plan to forget network after use	Medium

---

Frequently Asked Questions

Is public WiFi safe if I only visit HTTPS websites?

HTTPS protects the content of your connection to specific websites, but it does not protect everything. An attacker can still see which websites you visit (DNS queries, IP addresses), perform DNS spoofing to redirect you to phishing sites, or exploit other vulnerabilities. HTTPS is important but not sufficient — use a VPN as well for comprehensive protection.

Do I need a VPN for my home WiFi?

A VPN is less critical on your home WiFi if your network is properly secured with a strong password and WPA3 encryption. However, a VPN still provides value by hiding your browsing activity from your ISP. The most important use case for a VPN is on public and untrusted networks, where the risks are significantly higher.

Can coffee shop staff see my browsing activity? If you are using their WiFi without a VPN, the network administrator can potentially see which websites you visit (though HTTPS prevents them from seeing specific pages or content). If you use a VPN, they can only see encrypted traffic going to the VPN server. Always assume that network operators can see some level of your activity.

Is it safer to use my phone's mobile data than public WiFi?

In most cases, yes. Mobile data (4G/5G) is encrypted between your phone and the cell tower, and you are not sharing the connection with strangers. Using your phone as a personal hotspot for your laptop is generally safer than connecting to public WiFi. However, mobile data is not immune to all attacks — IMSI catchers (Stingrays) can intercept mobile signals, though these are expensive and typically used by law enforcement.

What should I do if I connected to a suspicious network?

1. Disconnect immediately 2. Enable your VPN before reconnecting to any network 3. Change passwords for any accounts you accessed while connected (do this from a trusted network) 4. Check your accounts for unauthorized activity 5. Run a malware scan on your device 6. Monitor your accounts for the next few weeks 7. Enable 2FA on all accounts if not already enabled

---

References

1. Coro Security. “Public WiFi Security Report 2025.” https://coro.co/
2. Kaspersky. “How to Stay Safe on Public Wi-Fi.” https://www.kaspersky.com/resource-center/definitions/what-is-a-vpn
3. Electronic Frontier Foundation. “Surveillance Self-Defense: VPNs.” https://ssd.eff.org/
4. Wi-Fi Alliance. “Wi-Fi Security Overview.” https://www.wi-fi.org/discover-wi-fi/security
5. Cloudflare. “What Is a Man-in-the-Middle Attack?” https://www.cloudflare.com/learning/access-management/man-in-the-middle-attack/
6. National Institute of Standards and Technology (NIST). “Guide to Enterprise Mobility Security.” SP 800-124 Rev. 2. https://csrc.nist.gov/

---

About the Author

The GeneratePass Editorial Team builds privacy-first security tools that run entirely in your browser. Every tool on GeneratePass processes data locally — nothing is ever sent to a server. Visit generatepass.me to try our free Password Generator, Entropy Calculator, and Breach Checker.