Is public Wi-Fi safe to use?

You've probably heard a lot about a lot about not connecting to public Wi-Fi networks unless it's an absolute emergency, and if you do, you shouldn't do any sensitive stuff on it. This was solid advice decades ago, and to an extent, it still is.

But has the internet changed enough so that public Wi-Fi networks are actually safe to use? Here's some food for thought.

Why is public Wi-Fi considered insecure?

Public Wi-Fi networks, such as those found in airports, cafes, and hotels, are normally considered by most experts as being inherently insecure primarily because they prioritize convenience and accessibility over data protection. After all, it's a network that has no password or security measures and, for the most part, everyone can log in. A fundamental flaw in most public hotspots is the lack of robust encryption. Any data transmitted between a user's device and the wireless router is sent in plain text, allowing cybercriminals connected to the same network to easily intercept and read sensitive information like emails, credit card numbers, and login credentials.

This can become a problem when malicious actors access the network. Perhaps the most prevalent threat on these networks is Man-in-the-Middle (MitM) attacks . In this scenario, a hacker positions themselves between the user and the connection point. Instead of communicating directly with the hotspot, the user's device unknowingly sends information to the attacker, who then relays it to the router. This allows the attacker to eavesdrop on the session, modify data in transit, or hijack the user's session cookies to access their online accounts without needing a password.

You also potentially face the danger of "rogue access points" or "Evil Twins." Attackers often set up malicious Wi-Fi hotspots with names deceptively similar to legitimate ones, such as "Free_Coffee_WiFi." When a user connects to this fake network, the hacker gains total control over the data stream and can direct the user to phishing sites or push malware onto their device. Even when accessing secure HTTPS websites, sophisticated techniques like SSL stripping can force a browser to downgrade to an unencrypted HTTP connection, rendering standard security measures useless.

Is it still the case today?

Don't get me wrong. Most of the stuff that I said above is true today. What has changed, however, is the actual security measures of the stuff we use on a daily basis. The landscape has changed significantly, and the "doom and gloom" advice about public Wi-Fi often lags behind modern technological realities.

"Don't connect to public Wi-Fi" was solid advice years ago, when most web traffic was HTTP (unencrypted). If you logged into a forum or checked email on public Wi-Fi, your password traveled in plain text. Today, the vast majority of the web is encrypted via HTTPS . Even if a hacker on a public network intercepts your data packets, they can't read the content. They'll see a garbled stream of ciphertext rather than your credit card number. And sure, an attacker might try to do SSL stripping to force you to the older, unencrypted HTTP to then snoop on your packets. But modern browsers and websites use HSTS to force your browser to use HTTPS when available. You can try this yourself by manually changing HTTPS to HTTP on your address bar right now—you'll just get forced back into HTTPS and into safety.

What about your apps? Most instant messaging apps, like iMessage or WhatsApp, support end-to-end encryption , where a message is encrypted on your phone, sent as indecipherable gibberish, and decrypted on the receiver's phone using unique, shared secret keys. Not even the app's maker can look at the messages, and of course, someone snooping into a public Wi-Fi network can't either.

Another lingering risk has been "DNS snooping," where a hacker can't see what you are reading on a site, but they can see which site you are visiting. Newer browser and OS features (like "Secure DNS" in Chrome or Android) encrypt these requests, blinding the Wi-Fi provider and potential snoopers from seeing even the domain names you visit.

Public Wi-Fi isn't going away, and it's widely used, so the Internet just adapted to its existence and implemented security measures, so it's way less risky to use. Risks still exist—a hacker can still set up an evil twin access point—but accessing a Wi-Fi access point at an airport to send an email is way less of a risk than it was before.

How can I make it even more secure?

If you still don't completely trust it, there's stuff you can do to actually make it even more secure. Probably the most effective additional measure is the use of a VPN . A VPN creates an encrypted tunnel for the entire device's internet connection, protecting not just web browsing but also background app data and operating system traffic that might otherwise leak information. This ensures that even the network administrator cannot see the metadata of your activity, such as the specific domains you are visiting or your IP address.

Disabling file sharing and network discovery features prevents other devices on the same public network from "seeing" your computer or attempting to access shared folders. On the privacy front, enabling DNS over HTTPS (DoH) in browser settings closes a common loophole by encrypting the directory lookups that tell the network which websites you are trying to reach.

And some common sense also goes a long way. You should verify the exact network name with venue staff rather than guessing, and treat any browser security warning as an immediate reason to disconnect. Two-factor authentication provides a safety net if you somehow mess all of this up, ensuring that even if credentials are somehow compromised via a social engineering attack, the account remains inaccessible to the hacker.

Check out Yahoo's latest VPN advice, based on hands-on testing.

Best VPNs in 2026 | The best VPNs for streaming in 2026 | The fastest VPNs in 2026 | Best VPN for Mac in 2026 | Most secure VPN in 2026 | 8 ways to make your VPN run faster | Does using a VPN impact internet speeds? | Are VPNs really safe? | See Yahoo Tech's full VPN coverage