Is Public Wi-Fi Safe? How to Protect Yourself

By NorwegianSpark Editorial · Published July 10, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

"Never use public Wi-Fi" is advice from a different decade. "Public Wi-Fi is perfectly safe" is not right either. The honest 2026 position is narrower and more useful than both, and the United States Federal Trade Commission states it plainly on its consumer advice page, checked at source on 6 September 2026: "Because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe."

That sentence did most of the work that a decade of scare stories claimed a VPN had to do. It is also doing a lot of quiet lifting in the word "usually". This guide is about what sits inside that word.

What changed, and why the old advice expired

The classic public Wi-Fi story was eavesdropping: a stranger on the same network quietly reading your traffic and lifting your banking password out of it. That story was accurate when much of the web ran unencrypted. It is largely obsolete now, because the connection between your browser and almost every site is encrypted end to end. Someone sharing the coffee shop network can generally see which servers you connect to. They cannot read what you send them.

So the threat did not disappear — it moved. It moved from the wire to the endpoints, and to you.

The risks that actually survived

The site itself being fraudulent. This is the FTC's own caveat, and it is the one most guides skip. Encryption protects data in transit; it says nothing about who is at the other end. In the FTC's words, your data "may be encrypted on its way to the site, but it won't be safe from scammers operating the site". A padlock proves a connection is private, not that the business is real.

Fake hotspots. A network named "Airport_Free_WiFi" costs nothing to create. Connect to the attacker's access point and they control your name resolution and your first hop, which is a far better position than passively listening. The defence is unglamorous: read the network name carefully, and where it matters, ask the venue which network is theirs rather than picking the most convincing name in the list.

The handful of things still unencrypted. A small number of apps, embedded devices and older internal tools still speak plainly. You rarely know which, which is an argument for a blanket layer rather than case-by-case judgement.

Shoulder surfing and left-open sessions. Deeply unfashionable, entirely real. A screen in an airport lounge is readable from two seats away, and a session left signed in on a shared machine is an open door with no technical component at all.

What the FTC actually recommends

The same page lists the precautions worth taking, and the list is shorter than most vendor guides imply:

• Look for "a lock symbol or https in the address bar to the left of the website address".
• Create and use strong passwords, and turn on two-factor authentication.
• Keep your security software, operating system and browser updated, and turn on automatic updates on your phone.
• Learn to recognise scammer tactics — impersonation and fake websites.

Notice what is not on that list: any instruction to avoid public networks, and any requirement to buy something. Three of the four are habits, and they protect you everywhere, not only on hotel Wi-Fi.

Where a VPN genuinely helps — and where it does not

That table is the whole argument. A VPN is a genuinely useful layer on a network you do not control, and it is not the universal shield it is sold as. If you want one, choose it on audited no-logs claims and jurisdiction rather than on speed graphs — the reasoning is in best VPN for privacy, and the features that matter are in the VPN buying guide. Providers commonly compared on those terms include NordVPN, Surfshark and the privacy-focused Proton ecosystem. Our sister site VPNTex tracks the field in more detail than we do here.

One warning that is worth repeating on any page that mentions VPNs: a free VPN is rarely free. Running servers costs money, and if you are not paying, the business model is usually your data — which inverts the entire point of using one on an untrusted network.

A practical routine that takes about a minute

• Turn off automatic joining for open networks, so your phone stops silently connecting to anything with a familiar name.
• Where the signal is good enough, use mobile data for banking and anything involving payment details, and treat that as the default rather than the exception.
• Confirm the network name with the venue before connecting on a device that holds work data.
• Sign out of sessions when you finish, particularly on a machine that is not yours.
• Keep updates on. This is the single highest-value item on the list and the one most often deferred.
• Turn on two-factor authentication so a captured password on its own is not enough.

The counter-argument worth taking seriously

Plenty of security professionals now argue that consumer VPN marketing has done real harm: it taught a generation that public Wi-Fi is a hacker's playground, and in doing so it displaced attention from the threats that actually empty accounts. Those are phishing and scam sites, and they work identically on your home broadband. CISA's own phishing guidance describes the tells — "urgent or emotionally appealing language", "requests to send personal and financial information", "untrusted shortened URLs", and lookalike addresses "like amazan.com".

That criticism is fair, and it is why this page leads with the FTC's "usually safe" rather than a warning. The correct posture is calm, not fearful: the network is rarely the problem, the site you are logging into might be. If you want to spend effort somewhere it pays, spend it on recognising phishing, on two-factor authentication or passkeys, and on the wider habits in protecting your privacy online. If you are travelling with devices that hold work data, travel device security covers the border and hotel questions this page does not.

Use HTTPS sites, keep everything updated, turn on a second factor, do not bank on a network you cannot verify, and add a reputable VPN as a layer rather than a cure. Which VPN, and whether you need one at all, is the question the security tool finder is built to answer. This is general guidance, not security advice for a specific threat model.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore