Tech

How to Tell If a Public Wi-Fi Network Is Safe to Use

Rive News Research Desk

Published October 16, 2026 · 9 min read

Key takeaways

A safe public network starts with the right network name, confirmed with staff, not just the strongest signal.
HTTPS and a lock symbol show the site encrypts your data, which matters most on shared networks.
A VPN, two-factor authentication, and logging out add layers that cover the gaps a network check cannot.

A workspace with a laptop, sandwich, and juice on a wooden table in a cafePhotograph: Shixart1985 / Wikimedia CommonsImage: Wikimedia Commons

A public Wi-Fi network is a shared network. Everyone in the cafe, airport, or hotel lobby who joins it sits on the same local connection as you. That shared setup is what makes the safety question worth asking before you connect.

The good news is that most websites now encrypt traffic between your device and the site. The United States Federal Trade Commission (FTC) notes that because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe. The catch is the word usually.

Encryption protects the trip between you and a site that uses it. It does not make a fake network honest, and it does not protect a site that skips encryption.

This article explains how to tell if a public Wi-Fi network is safe to use, including the network name, the password check, the HTTPS check, and the habits that cover the rest.

What a public Wi-Fi check actually tests

A quick check cannot prove a network is safe. No phone or laptop setting shows you who runs the router or whether someone nearby is watching traffic. What a check can do is filter out the obvious traps and push your sensitive activity behind encryption.

Think of it as three layers. The network layer asks whether the hotspot itself looks real. The site layer asks whether each site you visit encrypts your data.

The account layer asks whether a stolen password alone would be enough to break into your accounts. When all three layers hold, ordinary browsing on public Wi-Fi carries low risk. When one fails, change what you do on that network.

Step 1: Confirm the network name with staff

Attackers can set up a fake hotspot with a name that looks like the real one. The Federal Communications Commission (FCC) warns about imposter hotspots and advises checking with staff when more than one hotspot seems to belong to the place you are in.

Run this check before you connect. Ask an employee for the exact network name and whether it needs a password. Compare that name character by character with what your device shows.

Also watch for your home network name appearing while you are out. Turn off auto-connect for public networks, and forget networks you no longer use.

Step 2: Check whether the network asks for a password

A hotspot that asks for no password at all is not secure at the network layer. The FTC puts it plainly: if a hotspot does not require a password, it is not secure. Anyone nearby can join, and traffic on an open network has no wireless encryption between your device and the router.

A password is not a guarantee either. Many cafes print one password on a receipt and hand it to every customer. Everyone on that network shares the same key, so a stranger in the corner has the same network access you do.

A password keeps casual passersby out. It does not keep other paying customers from seeing unencrypted traffic.

What a password does tell you is something about the venue. A network with a WPA2 or WPA3 password has at least basic wireless encryption. An open network has none.

Treat a password as a small positive sign, not a verdict.

Step 3: Look for HTTPS on every site you use

This is the single most useful check on a public network. When a site address starts with HTTPS and your browser shows a lock symbol, the connection between your device and that site is encrypted. The FTC advises looking for the lock symbol or HTTPS in the address bar, and it notes that this works on a mobile browser too.

The "S" in HTTPS stands for secure. It means the data you send, including login details, is scrambled before it leaves your device. Someone watching the network would see scrambled traffic rather than readable text.

Check HTTPS on every page, not just the login page. Some sites encrypt only the sign-in page and leave the rest of the session open. The FTC has warned that if any part of a session is not encrypted, the whole account could be exposed.

If a site you need drops to plain HTTP, stop using it on that network and switch to your mobile data.

Mobile apps are harder to inspect. Most major apps do use encryption, according to the FTC, but an app gives you no lock symbol to verify. For banking or email inside an app on public Wi-Fi, a VPN or your phone data plan removes the doubt.

A woman drinks coffee while working on a laptopPhotograph: Shixart1985 / Wikimedia CommonsImage: Wikimedia Commons

Step 4: Watch for warning signs while you browse

A safe network behaves in a boring way. Pages load normally. No surprise pop-ups demand software updates.

Your browser does not flash certificate warnings. When something odd happens, treat it as information.

Virgin Media O2 lists unusual activity as a warning sign, including pop-ups, extra ads, slow speeds, and repeated disconnections. Any of these can have an innocent cause. A slow cafe network at rush hour is normal.

A sudden flood of pop-ups is not.

Browser certificate warnings deserve special care. If your browser says a site looks unsafe or its certificate does not match, believe it and leave the site. Do not click through the warning to reach a login page.

If you see warnings or strange behavior, disconnect from the network, forget it on your device, and switch to mobile data. Run a malware scan later if anything was downloaded or a pop-up was clicked.

Step 5: Use a VPN for sensitive work

A virtual private network (VPN) encrypts all traffic between your device and the internet. On a public network, that means even if the hotspot is open or fake, your traffic stays scrambled to anyone watching the local connection. The FCC advises regular hotspot users to consider a VPN, and it notes that many employers provide one for work use.

A VPN does not make you invisible. The VPN provider can see your traffic, so the choice of provider matters. The FTC advises researching a VPN app before you install it, checking what permissions it asks for and whether it shares your data with third parties.

For quick checks like reading news or checking a train time, HTTPS alone is usually enough. For email, banking, work systems, or anything that involves money, use a VPN or switch to your mobile data plan. The FCC notes that using your phone data plan instead of Wi-Fi may be more secure when you send sensitive information.

A ruler and a laptop on a deskPhotograph: Oli Dale / Wikimedia CommonsImage: Wikimedia Commons

Step 6: Lock down your accounts before you travel

Two settings do more than any network check. The first is two-factor authentication on your important accounts. With it turned on, a stolen password alone is not enough to sign in, because the attacker also needs the second factor, usually a code from your phone.

The second is unique passwords. If you reuse one password across sites, a leak from one service can open the rest. A password manager makes unique passwords practical.

For more on this, see how to check if your email password leaked in a breach and how two-factor authentication stops hackers.

Turn off file sharing, AirDrop, and Bluetooth discovery while on public networks. These features are built for nearby devices, which is exactly the crowd on a shared hotspot. Leaving them on invites connections you did not ask for.

What not to do on public Wi-Fi

Some tasks are worth delaying until you reach a trusted network. Do not send financial details by email, even on a network that looks safe. The FTC has long advised against emailing credit card, bank, or similar account numbers.

Do not stay signed in to accounts when you finish. Log out, then disconnect from the network. Staying signed in leaves a session that can be reused if something on the network goes wrong.

Do not ignore the feeling that a network is off. If the name is wrong, the password is missing, pages behave strangely, or staff cannot confirm the network, walk away from it. Mobile data is a known network run by your carrier, and when in doubt it is the safer pick.

A two-minute check sequence

Run these checks in order the next time you sit down with a laptop in a public place.

Ask staff for the exact network name and password, and match it on your device.

Confirm the network asks for a password, and note that a shared password still leaves you on a shared network.

Connect, then open one site and confirm HTTPS and the lock symbol before you log in anywhere.

Turn on your VPN if you plan to open email, banking, or work accounts.

Turn off file sharing and Bluetooth discovery.

When you finish, log out of accounts and disconnect.

This sequence takes about two minutes once it becomes a habit. It will not catch every threat, but it filters out fake hotspots, open networks, and unencrypted sites, which are the traps most people actually meet.

Is public Wi-Fi safe for banking?

Banking sites and apps use encryption, and most banks add their own fraud checks. Still, banking is the highest-value target on a shared network. Use your mobile data or a VPN for banking, and keep two-factor authentication on.

Does a password make public Wi-Fi safe?

No. A shared password keeps strangers off the network, but everyone who knows it shares the same local connection. Your safety still depends on HTTPS, a VPN, and account protections like two-factor authentication.

What is an evil twin hotspot?

An evil twin is a fake hotspot that copies the name of a real one. Your device joins the fake network, and the attacker can watch or redirect your traffic.

Should I use a free VPN on public Wi-Fi?

Be careful. A VPN provider can see your traffic, so a free service that sells browsing data trades one watcher for another. Research the provider first, and prefer one with a clear no-sharing policy.

The bottom line

You cannot judge a public Wi-Fi network by signal strength or by a friendly name. Check the name with staff, look for a password, confirm HTTPS on every site, and use a VPN or mobile data for anything sensitive. Two-factor authentication and unique passwords cover the cases where a network check fails.

With those layers in place, public Wi-Fi is a convenience you can use with clear eyes rather than a risk you ignore.

Tags: public Wi-Fi, Wi-Fi safety, online security, VPN

Latest in Tech

Subscribe for one practical security check each week.

Taggedpublic Wi-FiWi-Fi safetyonline securityVPN