How to Stay Safe on Public Wi-Fi

Free Wi-Fi at the airport, a cafe, or a hotel feels like a small gift when your mobile data is running low. But public networks have a reputation for being risky, and a lot of the advice online is either outdated or designed to scare you into buying something you may not need. This guide explains what actually threatens you on public Wi-Fi and the practical steps that keep your Android phone safe.

The short version is reassuring: thanks to modern encryption, ordinary browsing on public Wi-Fi is far safer than it was a decade ago. The remaining risks are real but avoidable once you know what to look for, and none of them require you to be a security expert to defend against.

What Has Changed: HTTPS Everywhere

Years ago, much of the web sent data in plain text, so anyone on the same network could potentially read what you typed. Today the vast majority of websites use HTTPS, shown by the lock-style padlock and the https prefix in the address bar. HTTPS encrypts the connection between your phone and the website, so even on shared Wi-Fi, others on the network cannot easily read your traffic.

This single change removed the most common old-school threat. It does not make public Wi-Fi risk-free, but it means the horror stories about someone effortlessly reading your passwords no longer match how the web works. Your browser also warns you loudly when a site is not secure, and those warnings are worth taking seriously rather than tapping past.

The Real Risks Today

If silent snooping is mostly solved, what remains? Three things matter most, and all of them rely on tricking you rather than breaking encryption.

• Fake hotspots: an attacker sets up a network named to look like the real cafe or airport Wi-Fi, hoping you connect and trust it.
• Phishing pages: once connected to a malicious network, you might be shown fake sign-in or payment pages designed to steal details.
• Unencrypted odds and ends: a small number of apps or sites may still not use proper encryption, leaking bits of data in the background.

Notice that all three depend on fooling you rather than defeating the maths. That is why your habits matter more than any single app you could install, and why staying calm and observant is your best defence.

Confirm the Network Before You Connect

An attacker’s favourite trick is the evil twin: a network with a familiar-looking name. Before joining, ask a staff member for the exact network name, and be suspicious of duplicates or slight misspellings. If two networks look almost identical, one may be fake and the other real.

Be especially careful with networks that require no password at all, and with sign-in pages that immediately ask for personal or payment details. A legitimate cafe rarely needs your card number to give you Wi-Fi. If a captive portal asks for anything beyond an email or a room number, treat it as a warning sign and close it.

Turn Off Auto-Connect

By default, phones may automatically reconnect to open networks they have seen before. An attacker can exploit this by broadcasting a common network name your phone remembers, so it joins silently without you noticing. Turn off auto-connect for open networks in your Wi-Fi settings, and forget public networks after you finish using them so your phone stops seeking them out.

1. Open Settings, then Network & internet, then Wi-Fi.
2. Tap the saved network, then choose Forget.
3. Look for an auto-connect toggle and switch it off for open networks.

This small habit means you always make a deliberate choice about which networks to trust, rather than leaving it to your phone.

Use Mobile Data for Sensitive Tasks

Your mobile data connection is encrypted between your phone and your carrier and is much harder to tamper with than a shared hotspot. For banking, UPI payments, or logging into important accounts, simply switch off Wi-Fi and use mobile data. It is the simplest safety upgrade there is, and it costs only a little data. If you want to keep an eye on usage so this habit does not eat your plan, see our guide on reducing mobile data usage on Android.

Should You Use a VPN?

A VPN routes your traffic through an encrypted tunnel to a server, which can add privacy on untrusted networks. It is genuinely useful if you regularly do sensitive work on public Wi-Fi. But a VPN is not magic, and a poor one can be worse than none, because it can see all your traffic. Free VPNs in particular often make money by logging and selling data, which defeats the point of using one for privacy.

If you decide a VPN is worth it, choose carefully rather than grabbing the first result. Our guide on how to evaluate a VPN app explains what to check before you trust one with your traffic, from its logging policy to who owns it.

Public Wi-Fi Do’s and Don’ts

Here is a quick reference you can act on immediately, whether you are in a lounge, a hotel, or a coffee shop.

Watch for Phishing Even Off Wi-Fi

Many attacks that seem tied to public Wi-Fi are really phishing that could reach you anywhere. A fake page asking you to re-enter your bank login, or a text claiming your Wi-Fi session expired, works the same on any network. Learning to spot these protects you everywhere, not just in a cafe. Our guide on how to spot a phishing text is a useful companion, and the same instincts apply to suspicious pop-ups on public networks.

The common thread is urgency. Scam pages and messages push you to act fast, before you think. Slowing down and checking the web address, the sender, and whether the request even makes sense will defeat most of them.

Keep Your Software Current

Security fixes for your browser and Android close the gaps attackers rely on. Keeping your phone updated is one of the most effective and least glamorous protections you have, because it removes the very weaknesses that malicious networks try to exploit. If you are unsure how updates work on Android, read how Android updates reach your phone.

Handling Public Charging and Shared Devices

Public Wi-Fi is not the only shared resource that carries a little risk. Public USB charging points, sometimes found in airports and stations, can in rare cases be tampered with to attempt data transfer rather than just power. The simple defence is to charge from a wall socket using your own adapter, or to use a portable power bank you carry with you. If you must use a public USB port, your phone will usually ask whether to allow data transfer when connected, and you should decline, choosing charge-only.

The same caution applies to shared or public computers. Avoid logging into personal accounts on a device you do not control, since you cannot know what software is running on it. If you have no choice, use a private or incognito browser window, log out fully when you finish, and change your password afterward from a device you trust. Treating any equipment you do not own as untrusted is a good general rule, and it costs you almost nothing while closing off a surprising number of avenues attackers rely on.

Building Good Habits That Travel

The best part of these habits is that they work everywhere. Whether you are in an airport in India or a hotel abroad, confirming the network, keeping HTTPS in view, and switching to mobile data for anything sensitive all behave the same way. You do not need a different plan for each place, only a consistent set of small checks that become second nature with a little practice. Over time you will find yourself doing them without thinking, which is exactly when they protect you best.

The Bottom Line

Public Wi-Fi is not the trap it once was, because HTTPS now protects most of what you do online. The threats that remain, such as fake hotspots and phishing pages, work by fooling you rather than cracking encryption, so awareness is your strongest tool. Confirm the network before connecting, turn off auto-connect, keep HTTPS in view, and switch to mobile data or a trusted VPN for anything sensitive. With those habits, you can enjoy free Wi-Fi without handing anyone your data.