What the risks really are
- Fake hotspots (“evil twins”): a network named like the café’s or hotel’s, set up to capture traffic or show fake login pages.
- Snooping on unencrypted traffic: anything not protected by HTTPS, including some apps and DNS lookups, can be seen by others on the network or by whoever runs it.
- Exposed devices: file sharing and other services on your laptop may be visible to others on the same network.
What HTTPS already protects
When a site uses HTTPS (the padlock in your browser), the content of your connection to it is encrypted, even on public Wi‑Fi. The network can still see which sites you connect to, though, and not every app or connection is encrypted. A VPN encrypts everything between your device and the VPN server and hides the sites you visit from the local network.
Simple habits for shared networks
- Confirm the exact network name with staff.
- Prefer your phone’s mobile data or personal hotspot for banking.
- Use a VPN with auto-connect on untrusted Wi‑Fi.
- Mark public networks as “public” on Windows, and turn off file sharing.
- Keep your device and apps updated, and use two-factor authentication on important accounts.
- Never enter passwords on a captive portal (the Wi‑Fi login page) that asks for more than it should.
Last updated: 13 October 2026
