You are at a coffee shop, an airport, or a hotel, and you tap "join" on a free network without thinking. That reflex is worth examining, because the risk profile of public Wi-Fi is both overstated and misunderstood. The old advice — "anyone can read everything you type" — is mostly wrong in 2026. The threats that remain are more specific, and defending against them takes a few deliberate habits rather than paranoia.

What actually changed: HTTPS won

A decade ago, an attacker on the same network could passively sniff traffic and read your email, form posts, and session cookies in plaintext. That threat is largely dead. The overwhelming majority of the web now runs on HTTPS, which encrypts the connection between your browser and the server. Someone capturing packets on an open network sees which domains you connect to, roughly how much data you move, and the timing — but not the contents of your requests or the pages that come back.

So the honest framing is: passive eavesdropping is no longer the main problem. The attacker has to actively interfere with your connection, and modern browsers make that loud and difficult. The real dangers are the tricks that get around HTTPS instead of breaking it.

The threats that still work

The evil twin

An attacker sets up their own access point broadcasting a familiar name — Starbucks_Free_WiFi, Airport_Guest, Marriott_Lobby. Your phone, which remembers networks by name, may join automatically. Now the attacker is your gateway to the internet. HTTPS still protects the contents of your sessions, but the attacker controls DNS, can serve captive portals, and can attempt downgrade attacks. This is the single most practical attack on public Wi-Fi, and it requires nothing more than a cheap router or a laptop.

Captive portal phishing

That "accept terms" or "enter your room number" page hotels and airports show you? It is a perfect phishing surface. A rogue portal can ask for an email and password, a credit card "to verify identity," or push a "required security certificate" you are told to install. Installing a certificate an attacker gave you is the one move that genuinely breaks HTTPS — it lets them decrypt everything. Never install a profile or certificate to "get online."

SSL stripping and downgrade

If a site is misconfigured — no HSTS, an http:// link somewhere in the flow — an active attacker can try to keep you on unencrypted HTTP and relay a downgraded version of the site. Well-run sites (banks, major providers) are protected by HSTS preloading, so this mostly hits smaller or older services. It is a good reason to type https:// yourself for anything sensitive rather than following a link.

Certificate-warning fatigue

When an attacker does try to intercept an HTTPS connection, your browser throws a full-page certificate warning. That warning is the system working. The failure mode is human: people click through it to make the annoyance go away. On an untrusted network, a certificate error is not a glitch — treat it as an attack until proven otherwise, and close the tab.

DNS and metadata

Even with everything encrypted, whoever runs the network sees your DNS lookups and destination IPs unless you hide them. That is a privacy leak — which services you use, and when — more than a theft-of-credentials risk, but it is real.

A realistic threat model

Put plainly: on a random open network, the person to worry about is not a genius decrypting your banking session. It is someone running an evil twin hoping you will auto-join, click through a warning, install their certificate, or type a password into their portal. Aim your defenses at those behaviors.

How to actually stay safe

1. Use your own connection when the data is sensitive. Mobile tethering is encrypted end to end by the carrier and sidesteps every local-network attack. For banking, logging into a new service, or anything you would hate to lose, a personal hotspot beats any coffee-shop network. Save the free Wi-Fi for reading and streaming.

2. Turn off auto-join and "ask to join networks." This kills the evil-twin advantage. Make your device connect only when you choose to, and forget one-time networks after you leave so it never silently rejoins an imposter.

3. Trust HTTPS, but never click past a certificate warning. The padlock is doing real work. A warning page means the chain of trust failed — do not proceed, do not "continue anyway."

4. Never install certificates or profiles to get online. Legitimate captive portals only need you to accept terms in a browser. Anything asking to install software or a certificate is hostile.

5. Use a VPN for the right reasons. A VPN encrypts the hop between you and its exit server, which hides your DNS and destinations from the local network and neutralizes downgrade tricks. But it is not magic — you are moving your trust from the coffee shop to the VPN provider, so a no-logs provider you actually trust matters. It is worth understanding when a VPN genuinely helps and when it does not before you rely on one as your only defense.

6. Prefer encrypted DNS. Enabling DNS-over-HTTPS (DoH) in your browser or OS keeps the local network from seeing or tampering with your lookups.

7. Assume the network is hostile and send nothing in the clear. If you must move a password or a file from an untrusted location, encrypt it before it touches the network.

Sharing secrets over a hostile network

This last point is where most people slip. You are working remotely, a teammate needs a database password or a config file, and you paste it into email or Slack. Even over HTTPS, that secret now lives on a server, in a mailbox, and in a chat log — long after the moment has passed.

SnapSend is built for exactly this. Your data is encrypted in the browser with AES-256-GCM before it leaves your device, and the decryption key lives only in the URL fragment, which is never sent to our servers. An attacker sniffing the network sees an encrypted blob; our own backend only ever stores ciphertext. The link self-destructs on first read. You can share a password or secret as a one-time link or send an encrypted file, and for the common case of handing off Wi-Fi credentials to a guest or a new hire, there is a dedicated share Wi-Fi password flow.

Quick checklist

Auto-join off; forget one-time networks after use.
Use mobile tethering for anything genuinely sensitive.
A certificate warning = stop, do not proceed.
Never install a certificate or profile to connect.
Type https:// yourself for banking and logins.
Encrypt secrets before sending; use a one-time link, not chat or email.

FAQ

Is public Wi-Fi safe if every site uses HTTPS? Mostly, for reading. The residual risks are evil twins, captive-portal phishing, and you ignoring warnings — none of which HTTPS alone prevents.

Do I really need a VPN? Not for basic browsing on HTTPS. It helps most when you want to hide destinations from the local network or you are on a network you actively distrust. See the VPN breakdown.

What is the single riskiest move? Installing a "required" certificate from a captive portal — it hands an attacker the keys to decrypt your traffic.

Public Wi-Fi is a tool, not a trap — but only if you stop treating every network as trustworthy by default. When you do need to hand a colleague a credential from the road, don't paste it into a chat window that will remember it forever. Send it as a self-destructing, end-to-end encrypted link instead.