The advice "never use public WiFi" has been repeated so many times it's become received wisdom. But is it still accurate in 2026? HTTPS is now nearly universal, TLS 1.3 is the standard, and most apps use certificate pinning. The threat landscape has shifted significantly. Here's what's actually dangerous and what you can ignore.
What HTTPS now protects you from
A decade ago, most websites used HTTP (unencrypted). An attacker on the same network could read everything you sent — login credentials, session cookies, personal messages. This was a genuine and serious risk.
Today, over 95% of web traffic is HTTPS-encrypted. When you connect to a bank, email provider, or social media site over HTTPS on public WiFi:
- Your login credentials are encrypted before leaving your device
- Your session cookies are encrypted
- The content of what you're reading, sending, or submitting is encrypted
- A passive attacker can see you're connecting to gmail.com, but not what you're doing or saying
Modern TLS (version 1.3) also provides forward secrecy — even if a session key is later compromised, recorded traffic from the past cannot be decrypted.
Real threat #1: Evil twin attacks
An evil twin is a rogue WiFi access point that mimics a legitimate one. An attacker sets up a network named "Coffee_Shop_WiFi" or "Airport_Free_WiFi" near a genuine network. Your device automatically connects to the stronger signal.
What an evil twin can actually do in 2026:
- Intercept HTTP traffic — Still works. The small percentage of sites still on HTTP will expose your activity.
- DNS manipulation — The attacker controls DNS, potentially redirecting you to fake sites. But HTTPS certificate warnings would alert you if the real site uses HTTPS.
- TLS downgrade attacks — Partially mitigated by HSTS (HTTP Strict Transport Security) preloading and modern browsers, but still possible against sites not on the HSTS preload list.
- Credential harvesting via fake captive portals — Many public networks use login pages. A fake captive portal can collect your credentials if you enter them.
Real threat #2: Captive portal credential theft
Legitimate hotel and airport WiFi networks often use captive portals — pages you must log into before getting internet access. Evil twin operators copy these portals exactly. If you enter your hotel room number, email, or any credentials into a captive portal, verify you're on the right network first.
Better practice: use your phone as a mobile hotspot for sensitive work rather than connecting to unknown networks.
Real threat #3: ARP poisoning (on unencrypted networks)
On unencrypted networks, ARP (Address Resolution Protocol) poisoning allows an attacker to intercept traffic between other network users and the gateway — a classic Man-in-the-Middle (MITM) attack. Combined with HTTP traffic, this is powerful. Against HTTPS with certificate pinning, it's largely neutralized.
Mostly mitigated: passive packet sniffing
Passive packet sniffing — simply recording all network traffic — was devastatingly effective when most traffic was unencrypted. Today, a passive attacker on your public WiFi network can see:
- ✅ Visible: which domains you're connecting to (DNS queries, SNI in TLS)
- ✅ Visible: timestamps and rough data volumes
- ❌ Hidden: login credentials (HTTPS)
- ❌ Hidden: content of pages visited (HTTPS)
- ❌ Hidden: messages sent (HTTPS + E2EE)
This is a significant improvement from the pre-HTTPS era, but it's not perfect — metadata (which sites you visit, when, and for how long) can still be informative.
Still a real concern: your device's attack surface
Being on a shared network exposes your device to direct network attacks — port scans, exploitation of vulnerable network services, or attacking the network stack itself. Ensure:
- Your OS firewall is enabled
- File sharing is disabled
- Your OS and apps are up to date (patches close vulnerabilities)
- You're not running unnecessary network services
Should you use a VPN on public WiFi?
VPNs are often recommended as a cure-all for public WiFi risks. The reality is nuanced:
✅ VPN helps with:
- Hiding which domains you're visiting from the network operator
- Protecting HTTP (non-HTTPS) traffic
- Defeating evil twin attacks that rely on DNS manipulation
- Adding a layer of protection on untrusted networks
⚠️ VPN does NOT help with:
- Malware already on your device
- Phishing attacks (fake websites)
- Your VPN provider seeing your traffic instead of the network
- Certificate pinning bypass on apps
A reputable no-logs VPN (Mullvad, ProtonVPN, IVPN) on public WiFi is a reasonable precaution, but it's not essential if you stick to HTTPS sites and keep your device updated.
Practical guide: public WiFi safety in 2026
Frequently asked questions
Is it safe to check my bank account on public WiFi?
In 2026, banking apps use HTTPS with certificate pinning, making interception essentially impossible even on hostile networks. The bigger risks are using your bank's website and accidentally accepting a fake TLS certificate, or entering credentials into a look-alike phishing site. If you see any certificate warnings, disconnect immediately.
Can someone see what I'm doing on public WiFi?
On HTTPS sites (the vast majority), they can see which domain you're connecting to (e.g., google.com) but not what you're searching or entering. On HTTP sites (rare now), they can see everything. App traffic over HTTPS is similarly protected, though some apps have weak TLS implementations.
Is mobile data safer than public WiFi?
For most threats, yes. Mobile carrier networks use stronger authentication (SIM-based) and encryption, making evil twin attacks and passive sniffing much harder. For sensitive banking or work, using 4G/5G data is often preferable to public WiFi.