Key takeaways
- The FTC says connecting through public Wi-Fi is usually safe because most websites and apps now use encryption.
- Look for ‘https’ or a lock icon in the browser’s address bar before entering personal information.
- Encryption doesn’t protect you from scam websites, which can be encrypted too.
- Keep your devices and browser updated, and turn on two-factor authentication for important accounts.
- Make sure you join the venue’s real network, and be careful with unexpected pop-ups or login pages.
Public Wi-Fi once came with dire warnings. Things have changed: most websites and apps now encrypt the information you send and receive. That doesn’t make every hotspot risk-free, but it shifts what you need to watch for.
What the FTC says now
According to the Federal Trade Commission, because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe.
- On websites, look for “https” or a lock icon in the address bar. That shows the connection to the site is encrypted.
- Most apps also use encryption, though it’s harder to check.
What encryption doesn’t protect you from
Encryption protects your data in transit. It doesn’t make a website trustworthy. The FTC warns that:
- Scam sites can be encrypted too, so a lock icon doesn’t mean a site is legitimate.
- Scammers impersonate well-known companies and government agencies to steal information.
So the main risk on public Wi-Fi is the same as anywhere else: being tricked into giving information to the wrong people.
Habits that help
- Keep devices updated. The FTC recommends keeping your operating system, browser and security software current, and turning on automatic updates.
- Use two-factor authentication on important accounts, as the FTC suggests, so a stolen password alone isn’t enough.
- Use strong, unique passwords for each account.
- Join the right network. Ask staff for the network name, and be cautious with look-alike names.
- Be careful with pop-ups and login pages. Don’t download “required” software to use a hotspot, and don’t enter passwords for unrelated accounts on a Wi-Fi sign-in page.
Quick tip: Turn off auto-join for open networks, and periodically clear out saved networks you no longer use. Your phone then won’t quietly connect to a hotspot with a familiar name.
When to use mobile data instead
If you’re doing something especially sensitive and aren’t sure about a network, switching to your phone’s mobile data or personal hotspot is a simple extra precaution. Keep an eye on your data allowance; our guide to mobile data explains how.
Your own network at home
At home, you control the Wi-Fi, so you can make it more secure. Our guide to securing your home Wi-Fi covers passwords, encryption settings and router updates.
FAQ
Do I need a VPN on public Wi-Fi?
For most everyday browsing on encrypted sites, it isn’t essential. A reputable VPN can add privacy on networks you don’t trust, but it doesn’t protect you from scam sites or phishing.
Is it safe to do online banking on public Wi-Fi?
Banking apps and websites use encryption, so it’s generally safe if your device is up to date. Many people still prefer to use mobile data for sensitive tasks, which is a reasonable extra precaution.
How do I spot a fake hotspot?
Check the network name with staff or signage. Be wary of networks with names that look almost right, or open networks that appear where the venue says it has none.
Should I turn off auto-join?
It’s sensible to stop your devices from automatically joining open networks you don’t know, and to forget networks you no longer use.
This guide is general information. Plans, prices and program rules change, so check the details with your provider and official sources such as the FCC and FTC before you decide.