Blog

Is Public Wi-Fi Safe? Mostly, if You Check the Network

An iPhone on a café table beside a coffee cup, with two identical paper lanterns hanging above it, one glowing warm and the other glowing a faint cold blue

Public Wi-Fi is usually safe for everyday browsing, since most sites and apps encrypt your data. The real risks are fake networks and what the network can see.

Marco Lee7 min read

Mostly, yes. Most websites and apps now encrypt what you send, so everyday browsing on public Wi-Fi is usually safe. The real risks are joining a fake network with a familiar name, and what the network can still see, like which sites you visit. Check the network name with staff, and if you’re unsure about a network, I’d use cellular data for banking.

Is public Wi-Fi safe with HTTPS?

Mostly. Public Wi-Fi used to be risky because most websites didn’t encrypt data. The FTC’s view now: “Because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe.” To check a website, “Look for a lock symbol or https in the address bar”. Apps are harder: “It can be hard to tell if a mobile app uses encryption, but the majority do” (FTC).

What HTTPS protects: websites that use it “help maintain the privacy and integrity of data, and the authentication of websites is also validated” (NIST NCCoE). In plain terms, other people on the network can’t read or change what you type into the page.

What it doesn’t protect:

  • Which sites you visit. “Even if the transmitted data was encrypted by the application, an attacker would be aware of the domains, internet protocol (IP) addresses, and services” your device connects to (NIST NCCoE).
  • Whether the site is real. Scammers “create fake websites and encrypt them to make you think they’re safe when they’re not.” Your data may be encrypted on its way to such a site, “but it won’t be safe from scammers operating the site” (FTC).
  • Plain HTTP pages. “HTTP doesn’t provide a secure connection.” Safari can warn you: go to Settings > Apps > Safari and, below Privacy & Security, turn on Not Secure Connection Warning (iPhone User Guide).

The real risks on public Wi-Fi

Look-alike and fake networks

In a 2020 warning about hotel Wi-Fi, the FBI described an “evil twin attack”: a criminal creates “their own malicious network with a similar name to the hotel’s network,” and guests connect to it by mistake. On a shared hotel network, criminals can “monitor a victim’s internet browsing or redirect victims to false login pages” (FBI IC3). This is the risk HTTPS helps least with, because the danger is a fake page you choose to type into.

For the specifics, see is hotel Wi-Fi safe and is airport Wi-Fi safe, which covers fake “free airport Wi-Fi” networks.

Open networks with no password

An open network has no Wi-Fi encryption at all. Apple says a network with security turned off lets anyone join and “monitor the websites you visit and other data transmitted over your network” (Apple Support). In iOS 27 such a network is labeled Unsecured Network. A network with old encryption shows Weak Security instead; what Weak Security means explains the difference.

What the network operator can see

Even with everything encrypted, whoever runs the network sees some of it. Apple: “information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit” (Apple Support). If your iPhone shows a Privacy Warning because the network blocks encrypted DNS, the names of the sites you visit “could be monitored and recorded by other devices on the network” (Apple Support).

Your phone’s Wi-Fi hardware address matters too. If a device uses the same one everywhere, “network operators and other network observers can more easily relate that address to the device’s network activity and location over time” (Apple Support). That’s what Private Wi-Fi Address, below, is for.

Is public Wi-Fi safe if it has a password?

A password means the Wi-Fi link is encrypted, which beats an open network. It doesn’t tell you who runs the network, and everyone in the room has the same password. The FBI notes that smaller hotels “post placards at the service desk stating the password,” and that a room number and password “only governs devices accessing the hotel’s network but does not provide a secure internet connection” (FBI IC3). I treat a public network with a password like any other public network.

Is public Wi-Fi safe on iPhone? What iOS already does

  • Private Wi-Fi Address. By default your iPhone uses “a different MAC address for each Wi-Fi network.” On a new network with WPA2 or stronger security it chooses Fixed. On one with weak or no security it chooses Rotating, which changes “every 2 weeks.” To check, go to Settings > Wi-Fi, tap the More Info button next to the network and tap Private Wi-Fi Address (Apple Support). Leave it on Fixed or Rotating.
  • Weak Security and Unsecured Network labels. They appear under the network’s name in Settings > Wi-Fi. Old security settings “cause your device to show a security warning” (Apple Support).
  • Auto-Join. Your iPhone “can automatically join only known Wi-Fi networks,” the ones it has joined before (Apple Support). That’s why I tidy up after a trip (below).
  • Limit IP Address Tracking. It’s set per network, on the same More Info screen, and hides “your IP address from known trackers” (iPhone User Guide). Turning it off for a Wi-Fi network also turns off iCloud Private Relay for that network on all your devices signed in to the same Apple Account (iPhone User Guide).
  • iCloud Private Relay, if you have iCloud+. Traffic leaving your iPhone “is encrypted and sent through two separate internet relays,” which keeps network providers from “collecting your browsing activity in Safari.” Turn it on in Settings > [your name] > iCloud > Private Relay (iPhone User Guide). It covers Safari, not your other apps, and it isn’t available in all countries or regions (Apple Support). More in how to hide your IP address on iPhone.

What I’d do on public Wi-Fi

  1. Check the network name with staff. The FBI’s advice for hotels: “Confirm with the hotel the name of their Wi-Fi network prior to connecting” (FBI IC3). I’d do the same anywhere. If two names look alike, ask which one is theirs.
  2. Use apps or HTTPS sites for anything sensitive. Use your bank’s own app, or a site you typed in or bookmarked, with the lock showing. If the network has a sign-in page, don’t install anything it asks for. If that page won’t load, see hotel Wi-Fi login page not showing.
  3. Use cellular for banking if you’re unsure. The FBI, again on hotels, says to avoid “sensitive websites, such as banking sites,” and to use “your phone’s wireless hotspot instead of hotel Wi-Fi” if you can (FBI IC3). On an iPhone, that just means turning Wi-Fi off for a minute. For a laptop, turn on Personal Hotspot, which “can be helpful when you’re not in range of a trusted Wi-Fi network” (Apple Support).
  4. Forget the network afterwards. Go to Settings > Wi-Fi, tap More Info next to the network, tap Forget This Network, then Forget. To keep the password but stop automatic joining, turn off Auto-Join instead (Apple Support). Apple notes that when a network uses a common name, devices that join it are “more likely to encounter other networks that have the same name, and then automatically try to connect to them” (Apple Support).
  5. Use a VPN on networks you don’t control. More on that next.

Is public Wi-Fi safe with a VPN?

Safer, with limits. A VPN “can ensure all communication to and from their applications is encrypted prior to leaving the device” (NIST NCCoE). The FBI suggests a reputable VPN “to encrypt network traffic, making it harder for a cybercriminal to eavesdrop on your online activity” (FBI IC3). With it on, the café’s network carries an encrypted connection to the VPN server instead of your traffic to each site.

What it doesn’t do: make a fake sign-in page safe, or stop you from typing a password into a phishing site. It also moves the view of your traffic from the Wi-Fi network to the VPN company, so you’re trusting them instead (is a VPN safe). On networks with a sign-in page, connect the VPN after you’re through.

To check it’s working, run the free VPN test with the VPN off, then on. The IP address and network websites see should change to the VPN server’s, with no WebRTC or IPv6 leak.

Where Mistero fits

Mistero can’t tell you whether a network is the real one or make a fake sign-in page safe, and it doesn’t show or manage the other devices on a network. Checking the name with staff is still on you.

What it does: Mistero VPN lets you “Connect with one tap on public Wi-Fi”, “Mask your IP address while the VPN is active” and “Turn on Kill Switch to help stop network traffic if the VPN disconnects.” Its security checks include “Check Wi-Fi for visible connection or DNS anomalies” (App Store listing, read Nov 5, 2026). More on Mistero VPN.

Sources

Pricing New subscribers can start a 3-day free trial. After the trial, the subscription renews automatically at $12.99 per week unless you cancel at least 24 hours before the trial ends, in Settings > [your name] > Subscriptions (Apple Support). There's also a one-time Lifetime purchase for $99.99. These are US App Store prices as of October 2026; the purchase screen shows the current price before you confirm.

Frequently asked questions

Is public Wi-Fi safe with a VPN?

Safer, yes. A VPN encrypts your traffic before it leaves your iPhone, so the Wi-Fi network carries a connection to the VPN server instead of your traffic to each site. It won't stop you from typing a password into a fake page, and the VPN company now sees what the network would have seen, so pick one you trust.

Is public Wi-Fi safe with HTTPS?

Mostly. HTTPS encrypts what you send to and receive from that site, so other people on the network can't read or change it. The network can still see which sites you connect to, and scam sites use HTTPS too, so check the address before you type anything.

Is public Wi-Fi safe if it has a password?

A password means the Wi-Fi link is encrypted, which beats an open network. But a café or hotel password is shared with everyone there, and the FBI notes that a hotel's room number and password only control who gets on the network, not whether your connection is secure. I treat it like any other public network.

Is public Wi-Fi safe for banking?

Your bank's app and website use encryption, and the FTC says public Wi-Fi is usually safe because of it. If you're not sure the network is the real one, I'd turn Wi-Fi off and use cellular data for banking. It costs a little data and removes the doubt.
View All Blogs
VPN7 min read5 Nov, 2026Is Airport Wi-Fi Safe? What to Check Before You ConnectAirport Wi-Fi is fine for everyday browsing on the airport's real network. How to spot fake hotspots, what's known about juice jacking, and what to use instead.VPN7 min read5 Nov, 2026Is Hotel Wi-Fi Safe? The Real Risks and What to DoHotel Wi-Fi is shared with every guest, and a room-number login isn't encryption. Confirm the network name, use a VPN after signing in, bank on cellular.VPN6 min read2 Nov, 2026Weak Security Wi-Fi on iPhone: What It Means, How to Fix ItYour iPhone says Weak Security when a Wi-Fi network uses WEP, WPA or TKIP. Fix it on your router, or use cellular or a VPN on networks you don't control.