Public WiFi security on the road: risks you can’t ignore, and a simple routine for peace of mind

Public WiFi security in 2026: what changed

The train WiFi wants your email. The hostel password hangs next to the fridge. The café writes it on the board. Old guides make every hotspot feel like a trap, then, once you’re worried, pitch a subscription in the last paragraph.

Take a breath. The reality in 2026 is calmer. The real risks are a stolen laptop, an account without a second factor and a workday without working internet. Get clear on what can still happen on open WiFi, how to protect your devices and what to do when there’s no network at all, so you can focus on what matters.

What HTTPS already covers

That chilling story about an attacker stealing your passwords on café WiFi? It belongs to a time when websites sent data unencrypted. That time is over. According to Google's Transparency Report, more than 9 in 10 page loads in Chrome use HTTPS, depending on the platform. The US Federal Trade Commission also says encryption has largely defused the classic eavesdropping risks of public networks. You deserve peace of mind built on facts, not fear designed to sell.

Here’s what that means for you: someone on the same network cannot read the content of your connections to HTTPS sites. Not your password. Not your card number. Not your email. As long as the site and app encrypt properly, that content stays protected. And modern browsers warn you before you type credentials into an unencrypted page. That protection matters.

Open WiFi is much less dangerous than VPN marketing claims. Don’t let a terrifying sales pitch convince you otherwise. Anyone claiming otherwise, then selling you a product in the next paragraph, is ignoring the state of the art. Your peace of mind shouldn’t come with a fear-driven sales pitch.

Where public networks can still leave you exposed

Defused does not mean harmless. Don’t let your guard down: these four residual risks still demand your attention.

Evil twin hotspots. That familiar network name could betray your trust. An attacker sets up a convincing hotspot, such as a second "Airport_Free_WiFi". Your device connects, and just like that, the attacker is in the middle, operating your network. They still cannot read HTTPS content, but they control your login page and can see which services you contact. The US National Security Agency describes this pattern in its guidance on wireless devices in public settings. Take back control: turn off automatic connection to known networks and forget networks after use.

Captive portals. That hotspot login page? You see it before encryption of your actual destinations kicks in, and it can look like anything. It might ask for a room number or email address. But a portal that wants credentials for other services or card details is not a login page but a phishing form. Your trust is exactly what it’s after. Don’t hand it over. Close it.

DNS. Where you browse is your business. Yet before your device opens a website, it requests the site's address in plain text unless you change that. The network operator cannot see what you do on a site, but can see which services you visit. Ready to reclaim that extra privacy? Switch on encrypted DNS in your browser or operating system. DNS over HTTPS was standardized in RFC 8484 and is one switch away in current browsers.

Legacy software and neighbors on the network. Yesterday’s software can let today’s protection down. Older apps, badly built devices and internal company systems sometimes still communicate unencrypted or skip certificate checks. And you’re not alone: other people’s devices share your network, too. Put your protection first: turn off file and printer sharing, and set the network profile to "public" so your firewall closes up.

Session hijacking, the favorite scare of old guides, mostly fails against modern services, which set their session cookies securely and encrypt them. It survives where software is outdated. Don’t let old scare stories distract you from what matters: Keeping your software updated protects you more than any add-on product.

VPN: what it does and what it does not

That public hotspot should not leave you feeling exposed. A VPN builds an encrypted tunnel from your device to a VPN server. Anyone between you and that server, including the hotspot operator and any evil twin, sees encrypted traffic, not which services you use. That is the protection that matters: transport encryption for networks you do not trust, including your DNS queries.

But do not mistake protection for invincibility. A VPN does not make you anonymous or protect against phishing, malware or a weak password. Trust does not disappear; it changes hands: instead of the café owner, the VPN operator now sees your traffic. Only using current apps and HTTPS services? You are fine without one. Using company systems or want to keep metadata private? Use one. You will not find a product recommendation here.

The bigger risk: your device, not the network

Your laptop vanishes from a six-bed dorm without a locker. Your stomach drops. That’s far more likely than a targeted radio attack on you. The thief on the train is the realistic threat; the hacker at the next table is the exception. Don’t wait for that awful moment. Protect your device now:

• Turn on full-disk encryption. FileVault on a Mac, BitLocker on Windows; phones are encrypted by default once a screen lock is set.
• Set a short screen lock, on your laptop too.
• Install updates right away. Close the gaps that attacks on other people’s networks actually exploit.
• Turn on location tracking and remote wipe before your device disappears.

Act now, not when panic hits. Our guide to cybersecurity for digital nomads walks you through the full setup, from emergency lock to backup recovery.

Redundancy: an outage is more likely than an attack

Your biggest WiFi nightmare on the road isn’t a hacked connection. It’s having no connection when you desperately need one. The hotel WiFi drops before a client call, the coworking router hangs, the train WiFi never really worked. Don’t leave your work at its mercy. If you work on the road, you need two ways online through two different operators.

That backup costs surprisingly little: a local SIM or eSIM with a data package, activated in minutes, plus your phone as a hotspot. WiFi fails? You’re back on mobile data in under a minute. Roaming on your home plan can bridge a gap, but its limits usually aren’t built for months of work abroad; in the EU, fair-use rules apply. For longer stays, a local plan is almost always the better base. And for anything sensitive, your own mobile connection is the clean alternative to someone else's WiFi.

Two small essentials stand between you and that sinking feeling. A power bank, because your backup uplink is useless when your phone dies after two hours as a hotspot. And offline readiness: maps downloaded, current work documents synced locally and your 2FA app working without a network. Suddenly, an hour without signal is just an annoyance, not a lost workday. If this is your permanent lifestyle, as it is for a perpetual traveler, make this layer normal, not an emergency kit.

Banking and client logins: protect what matters at the account level

Your money. Your clients. Your peace of mind. When you’re on the road, use your own mobile connection for sensitive tasks rather than public WiFi. Not because the WiFi is likely to compromise them, but because it takes the residual risks off the table. The crucial truth? Your account security is decided at the account level, not the network level.

Start with passkeys wherever a service offers them. A passkey is bound to the service’s real address and simply won’t work on a phishing site. That’s why the US standards body NIST classes the method as phishing-resistant in its digital identity guidelines. Next, choose an authenticator app that generates codes offline. SMS comes last, and abroad, you’re also relying on your home number receiving messages. Want accounts and cards that fit your life on the move? That deserves its own guide: see banking for digital nomads.

Your peace of mind in five steps

1. Auto-connect off, forget networks after use. Don’t gamble on airport instincts: this defuses evil twins better than any gut feeling.
2. Sharing off, network profile set to "public". Take control. Your firewall does the rest.
3. Updates and disk encryption on. Protect what’s most exposed: your device is the likelier target, not your radio traffic.
4. Sensitive tasks over your own eSIM, not portal WiFi. Don’t risk it: never type credentials or card details into a captive portal.
5. A second uplink, a power bank and offline copies. Stay ready. Reliability is the part of security you need most often.

Now approach the next "Free WiFi" with confidence, not crossed fingers: a convenience whose limits you know, with a plan B in your pocket.

Frequently asked questions

Is public WiFi safe to use?

Mostly, if you stick to HTTPS sites and up-to-date apps. Here’s the reassurance: according to Google's Transparency Report, more than 9 in 10 page loads in Chrome use HTTPS, so others on the network cannot read the content. But don’t let your guard down: evil twin hotspots, fake login portals, unencrypted DNS and outdated software remain real risks.

Do I need a VPN on public WiFi?

Not necessarily. Want more privacy? A VPN encrypts your traffic and DNS queries against the hotspot operator, but it’s no shield against phishing, malware or weak passwords. And you still have to trust the VPN provider. For company systems or keeping metadata private, it makes sense. Know what you’re protecting, and don’t mistake a VPN for complete protection.

What is the best backup for WiFi when traveling?

Don’t let dead WiFi derail your trip. Take a local SIM or eSIM with a data package from a different operator than the WiFi, use your phone as a hotspot, and pack a power bank, plus offline copies of maps, documents and your 2FA app.