Last updated: November 2026
Affiliate Disclosure: Trident is reader-supported. Some links on our site are affiliate links. When you buy through those links, we may earn an affiliate commission — at no extra cost to you. Links to a brand's official site are not affiliate links. Learn more
People searching for whether public Wi-Fi is safe are usually about to join a coffee shop, airport, or hotel network with a laptop full of work logins. The Federal Trade Commission’s current answer is more specific than a yes or no. On Are Public Wi-Fi Networks Safe?, the FTC says hotspots in coffee shops, malls, airports, and hotels used to put your information at risk, because most websites did not encrypt traffic and someone on the network could snoop. The FTC says most websites encrypt now. Because of that, connecting through a public Wi-Fi network is usually safe when you can see a lock or https in the address bar.
The Wi-Fi link is a different question from the website. CISA’s wireless-network guidance says many public access points are not secured, and the traffic they carry is not encrypted. CISA and the FCC also describe imposter hotspots that copy a real network name. This page is the checklist for that gap. NordVPN is the VPN we recommend when the network is not yours. A password manager is the second tool, so you are not retyping a reused password on a network you just joined.
Is public Wi-Fi safe?
For a normal website that shows a lock or https, the FTC says the connection is usually safe. The same check works in a mobile browser. The FTC also says it can be hard to tell whether a mobile app encrypts, though most apps do. That is the part a lock icon answers.
It does not tell you whether you joined the network the café, the airport, or the hotel actually runs. CISA says that on many public access points the traffic is sent in the clear, and that sniffing tools can capture passwords or card numbers from traffic that is not encrypted. An old login page, a captive portal, or an app that is still on a plain connection is the traffic that stays exposed. Encrypted website sessions are why the FTC calls public Wi-Fi usually safe. They are not a reason to skip the checks below, especially for banking, email, and work logins.
CISA’s device guidance is stricter about those logins. It says not to do online shopping, banking, or sensitive work on a public wireless network, and that a mobile connection is generally more secure. Where the two pages differ, use the stricter step for anything that involves a password or a card, and use https for ordinary browsing.
Risks that are still real
These are the problems named in CISA and FCC consumer guidance. The agencies do not publish a rate for how often each one happens, and this page does not invent one.
| Risk | What it is | What to do |
|---|---|---|
| Unencrypted hotspot | The access point does not encrypt traffic. Passwords and card numbers sent without https can be read on the network. | Confirm the name. Prefer a network that uses WPA2 or WPA3. Use https. |
| Evil twin hotspot | An attacker copies the real network, often with a stronger signal or the same name as one you have joined before. | Ask staff for the exact network name and login steps before you connect. |
| Man-in-the-middle | CISA classifies the evil twin as an adversary-in-the-middle. Traffic passes through the attacker, who can monitor it, change it, or try to intercept https. | Leave any network you did not confirm. Use a VPN so the tunnel is encrypted past the local hotspot. |
| Fake captive portal | A login page after you connect that is built to collect a password, an email address, or a card number. | Type only what the staff said the real portal asks for. If it asks for more, disconnect. |
| Session snooping | Someone on an open hotspot collects an unencrypted login, or reads what an evil twin can see because your traffic crosses their system. | Do not sign in on a page without https. Log out when you finish. Forget the network. |
Unencrypted coffee shop, airport, and hotel Wi-Fi
CISA’s wireless sniffing section says many public access points are not secured and do not encrypt the traffic they carry. On that kind of network, information you send without encryption can be read by someone else using it. CISA’s instruction is to connect to access points that use at least WPA2. A hotspot that never asks for a password is not giving you that. The FCC describes WPA3 as the current standard when your device supports it, and WPA2 when the device is older.
The FTC’s check covers the website half of the trip: look for the lock or https on every page, not only the first screen. The FCC says the same thing in plainer language. The “s” in https means the data you transmit is encrypted. A coffee shop login, an airport webmail tab, and a hotel booking page all need that check. If the address starts with http and there is no lock, do not type the password there.
Rogue evil twin hotspots
CISA describes an evil twin this way. An attacker gathers information about a public access point, sets up a system that impersonates it, and uses a broadcast signal stronger than the real one. Unsuspecting people connect to the stronger signal. Because they are then reaching the internet through the attacker’s system, CISA says it is easy for that person to read data they send, including card numbers and username and password combinations. CISA’s instruction is to confirm the name and the password of a public hotspot before you use it.
The FCC describes the same moment from the lobby. If more than one hotspot looks like it belongs to the place you are in, ask the staff so you do not join an imposter. CISA’s device page says to confirm the network name and the exact login procedure with staff at an airport, a hotel, a station, or a café.
You can also be pulled onto a twin without tapping the wrong row. On CISA’s evil twin technique page, a malicious access point can listen for the probe requests a device sends for networks it has joined before, then answer with that same name. The device treats the answer as the saved network. Airports, coffee shops, and libraries are the places CISA names as likely spots for a fraudulent access point. That is why auto-join belongs off, and why you forget the network when you leave.
Man-in-the-middle on the hotspot
CISA files the evil twin under adversary-in-the-middle, technique T1557.004. That is the man-in-the-middle case travelers run into: the attacker sits on the path between your laptop and the internet. Once you are on the fraudulent network, CISA says that person may monitor network activity, manipulate data, or steal more credentials. The same page says custom certificates may be used in an attempt to intercept HTTPS. Keep checking for the lock. Treat a certificate warning as a reason to disconnect, not as a prompt to click through.
Fake captive portals
Airports and hotels often show a page after you connect. It might ask for a room number, a last name, an email address, or a code from the front desk. That page can be the real portal. It can also be the fake login page or captive portal CISA describes, whose purpose is to capture credentials.
Before you type, ask the desk what the network is called and what the login page is supposed to request. Type only that. If the page asks for a password, a payment card, or an account the staff did not mention, close it and forget the network. Use your phone’s hotspot for the login you actually need. A portal is not a place to enter your email password “to get online.”
Session snooping
Session snooping is CISA’s in-the-clear case. On an unsecured access point, sniffing tools can collect passwords and card numbers from traffic that was never encrypted. The FTC describes the older version of the same problem: someone on the network snooping because the website did not scramble the data. A sign-in on a page without https is that session.
An evil twin widens it. CISA says the attacker can read data that passes through their system, not only traffic that was sent without encryption. Log out of each account when you finish so a shared computer is not left signed in to your mail. Then forget the network.
A checklist before you connect
Do these in order on coffee shop Wi-Fi, airport Wi-Fi, and hotel Wi-Fi. The agency line is named where the step comes from a published page. The password-manager step is ours: it is how you follow the FCC’s instruction not to reuse passwords without typing them on a network you do not trust.
- Verify the network name with staff. The FCC says to check with staff when more than one hotspot looks like it belongs to the business. CISA says to confirm the name and the exact login steps so you know the network is legitimate. Read the name back. “Hotel WiFi,” “Hotel WiFi Fast,” and “Hotel_WiFi_Free” are not the same network.
- Prefer HTTPS. The FTC says to look for a lock or https to the left of the address, on a computer or a phone. The FCC says not to exchange information with a site that does not start with https. Check it again after a redirect. A captive portal that jumps you to a login is a new page, and it needs the same look.
- Turn off auto-join and file sharing. The FCC says to set your phone so it does not automatically connect to nearby Wi-Fi that is not on your short list of trusted networks. CISA says to disable file and folder sharing on public networks and to allow sharing only on home or work networks you recognize. Turn sharing off before you join, not after you notice a prompt.
- Use a VPN. The FCC says that if you use public hotspots regularly, consider a VPN, because it encrypts transmissions between your device and the internet. Connect the VPN before you open mail, work files, or a bank. NordVPN is the service we recommend for that. The button below is an affiliate link.
- Turn on two-factor authentication. The FTC says to create strong passwords and to turn on two-factor authentication where the account offers it. A password stolen from one login is much less useful if the account also asks for a second check. Email and the bank come first, because those two reset everything else.
- Use a password manager instead of typing a reused password. The FCC says not to use the same password on multiple accounts, especially bank, card, email, tax, and medical accounts. Typing that shared password into a café login is the habit to drop. A password manager keeps a different password for each site and fills it for you. NordPass is the manager we review. The password manager roundup compares the others. The NordPass button is an affiliate link.
- Forget the network when you leave. Log out, then remove the hotspot from your saved networks and leave auto-join off. CISA says devices send probe requests for networks they have joined before, and a malicious access point can answer with the same name. Forgetting the café and the hotel means your device stops sending that name in those probes.
- Use your phone’s hotspot when you can. The FCC says your cellphone data plan may be more secure than Wi-Fi when you are sending sensitive information. CISA says a mobile network connection is generally more secure than public Wi-Fi, and it says not to bank, shop, or do sensitive work on the public network. If the staff cannot confirm the name, or the portal looks wrong, tether from your phone and leave the airport or hotel Wi-Fi for maps and menus.
Use a VPN on networks you do not control
A VPN is the tool the FCC points at for people who use public hotspots on a regular basis. It encrypts the traffic between your device and the VPN provider, which closes the in-the-clear hop CISA describes on an open access point. It also covers apps, where the FTC notes you often cannot see whether the connection is encrypted.
NordVPN is our recommendation for coffee shop, airport, and hotel Wi-Fi. Turn it on before you join the network, and turn the kill switch on so a dropped tunnel does not quietly send the next minute of traffic straight onto the hotspot. Our NordVPN review covers the apps and the settings. The travel VPN guide covers streaming and restricted networks once you are connected. The remote-work VPN guide covers a laptop you also use for a job. This page stays on the safety checklist.
One limit, so the button is not doing more work than the product can. The FTC says scammers encrypt fake websites. A VPN encrypts the path. It does not make a fake hotel portal, a fake bank page, or a lookalike café login legitimate. If the site is wrong, the tunnel still delivers you there.
A personal VPN is also not your employer’s VPN. If the company issued one for internal systems, keep using that for work resources. NordVPN is for the rest of the traffic on a network you do not control.
Protect public Wi-Fi with NordVPN
Stop typing reused passwords
The risky moment on hotel Wi-Fi is often not the browsing. It is typing a password you also use for email. The FCC tells you not to reuse passwords on sensitive accounts. Doing that from memory, on a network you joined ten minutes ago, is how one exposed login becomes several.
NordPass stores a unique password per account and fills it, which is the practical version of that FCC rule. You still need a strong master password, and you still turn on two-factor authentication on the email account that can reset the others. See the NordPass review for what the vault includes. The button uses Trident’s NordPass affiliate link and does not add a charge at checkout.
See the current price at our link
If you already typed a password on the wrong network
Change that password from a connection you trust: your phone on cellular, or a home network. Start with email, then the bank and any account that reused the password. Turn on two-factor authentication while you are there. The FTC lists both strong passwords and two-factor authentication as the account steps that apply no matter how you get online.
If the page collected more than a password — a card number, a government ID, or other identity details — treat it as an exposure, not only a bad login. Change the credentials, and watch the accounts. Aura is the identity protection service we review for people who want monitoring and recovery help after information was exposed. The button is an affiliate link. Plan details are on the review, not on this page.
What a VPN will not fix
CISA also lists shoulder surfing: someone simply watching you type. A VPN does not cover the screen. Sit so the keyboard is not facing the queue, and do not read a banking code aloud at the gate.
A VPN does not patch the laptop. The FTC says to keep security software, the operating system, and the browser updated, and to turn on automatic updates, including on your phone. Do that before the trip, on a network you already trust.
A VPN does not replace the staff check. If you cannot confirm the name, do not join it. The phone hotspot is the backup, not a second guess at “Airport Free WiFi.”
Use NordVPN on the next network
FAQ
Is public Wi-Fi safe?
The FTC says public Wi-Fi in coffee shops, airports, and hotels is usually safe now because most websites encrypt the connection. Check for a lock or https in the address bar. The network itself is a separate question. CISA says many public access points are not secured and do not encrypt the traffic they carry, and that an evil twin hotspot can impersonate the real one. Use the checklist on this page before you type a password.
What is an evil twin Wi-Fi hotspot?
CISA describes an evil twin as an attacker who copies a public network and broadcasts a stronger signal, so people connect to the attacker's system instead of the real access point. CISA also says a fraudulent access point can reuse a legitimate network name, answer when your device looks for a network it has joined before, and send you to a fake login page or captive portal. Confirm the exact network name and login steps with staff before you connect.
Does HTTPS protect me on public Wi-Fi?
The FTC says a lock or https means the site is encrypting what you send, which is why public Wi-Fi is usually safe for those sites. The FCC says the s in https means the transmitted data is encrypted. HTTPS does not mean the site is legitimate. The FTC says scammers encrypt fake websites too, so the data can be encrypted on the way to a site that is still run by a scammer. CISA also says custom certificates may be used to try to intercept HTTPS on a malicious access point.
Should I use a VPN on coffee shop, airport, or hotel Wi-Fi?
The FCC says that if you use public Wi-Fi hotspots regularly, consider a VPN, which encrypts transmissions between your device and the internet. That covers app traffic where you cannot see an address bar. NordVPN is the VPN this site recommends for that job. A VPN does not make a fake website legitimate, and it does not stop someone looking over your shoulder.
Is a phone hotspot safer than hotel or cafe Wi-Fi?
The FCC says that when you are sending sensitive information, your cellphone data plan may be more secure than Wi-Fi. CISA's device guidance says a mobile network connection is generally more secure than a public wireless network, and it says not to do banking, shopping, or sensitive work on public Wi-Fi. Use your phone's hotspot when you cannot confirm the network name, or when you need to sign in to a bank or to work.
What should I do after I use a public network?
Log out of the accounts you opened. Turn off auto-join, and forget the network so your device stops looking for that name. CISA says devices send probe requests for networks they have joined before, and a malicious access point can answer with the same name. CISA also says to turn off file sharing on public networks.
Which links on this page are affiliate links?
The NordVPN buttons and the NordPass buttons are affiliate links. The Aura button is an affiliate link. Links to the FTC, CISA, and the FCC go to official sites and are not affiliate links. Buying through an affiliate link may earn Trident a commission at no extra cost to you.
Sources
Checked against the pages below in November 2026. Agency wording changes. Use the link for the current guidance.