Is public Wi-Fi safe? When you actually need a VPN

Free Wi-Fi is everywhere: cafés, hotels, trains, airports and libraries. It’s convenient, but is it safe to use? The honest answer is “mostly, if you’re sensible”, and knowing why helps you decide when extra protection is worth having.

What’s changed: HTTPS is everywhere

Ten years ago, much of the web wasn’t encrypted, and anyone on the same network could read what you sent. Today, almost every website you use, including your bank, email and social media, uses HTTPS. That padlock means the contents of the page are encrypted between your device and the website, even on public Wi-Fi.

The risks that remain

• Fake hotspots. Anyone can create a network called “Free Station Wi-Fi”. If you connect to one, its owner can see which websites you visit and try to send you to fake login pages.
• Who you’re talking to. HTTPS hides what’s on a page, but the network can still usually see which websites you’re visiting.
• Apps and devices that don’t encrypt. Not every app is as careful as your browser.
• Login pages and pop-ups. Wi-Fi sign-in pages can be used to collect personal details or push you towards malicious downloads.

Simple habits that keep you safe

• Check the network name with staff before connecting.
• Look for the padlock, and never type passwords into a page without one.
• Turn off automatic connection to open networks on your phone.
• Keep your phone and laptop updated.
• Use your phone’s mobile data for anything sensitive if you’re unsure about a network.

When a VPN genuinely helps

A VPN (virtual private network) encrypts all your internet traffic, from every app, and sends it through a secure server before it reaches the internet. On public Wi-Fi, that means the network’s owner, or anyone on it, sees only scrambled data going to the VPN, not which websites you visit.

A VPN is worth it if you regularly work on public or hotel Wi-Fi, travel for work, or handle client or business information away from the office. It isn’t magic: it won’t stop you clicking a phishing link or make a dodgy website safe. But it closes the gaps that HTTPS leaves.