Public Wi-Fi is safer than its reputation, and the danger has moved. Because most websites now encrypt traffic, connecting through a public network is usually safe, per the Federal Trade Commission. The documented risks that remain: fake hotspots, snooped screens, and open file sharing, per the Cybersecurity and Infrastructure Security Agency. The catch: an encrypted connection to the wrong site protects no one.
Two federal documents anchor this guide. The FTC's consumer advice, dated February 2023, explains the encryption reality on today's networks. CISA's wireless guidance, released February 1, 2021 and now archived on its site, covers the attack patterns worth knowing. Where the documents stop, this guide says so.
Is Public Wi-Fi Actually Safe Now?
Usually, yes, per the FTC: most websites use encryption, so the coffee-shop router is no longer the weak link it once was. Check for the lock symbol or https in the address bar, which works on a mobile browser too. The FTC adds one limit: apps mostly encrypt as well, but it can be hard to tell.
The history matters here. In the past, unencrypted websites left public-network users exposed to anyone snooping on the same network, the FTC explains. Widespread site encryption closed most of that window. The habits that remain are about the ends of the connection, not the pipe. We covered a connected angle in How to Check if Your Data Was Exposed in a Breach — and What to Do Next.
What Still Goes Wrong on Public Networks?
CISA's guidance names four risks that survive the encryption era:
- Evil twins: an attacker impersonates the real hotspot and broadcasts a stronger signal, then reads what victims send, per CISA.
- Wireless sniffing: on access points without encryption, traffic moves in the clear, so CISA says connect only to networks using at least WPA2.
- File sharing: open shared folders on a public network invite strangers in, so sharing stays off until you are home.
- Shoulder surfing: a glance over the seat captures passwords as easily as software does.
The file-sharing risk has a concrete shape. An unsecured public network combined with open sharing can let a malicious user reach directories and files you never meant to expose, per CISA. Its fix costs nothing: deny sharing on public networks, allow it only on the home network, and turn it off when the job is done. For screens, the agency notes privacy protectors that block side views sell for little money.
How Do You Spot a Fake Hotspot?
Ask before connecting. CISA's rule: always confirm the name and password of a public Wi-Fi hotspot prior to use, so the network matches what the venue actually runs. The strongest signal is not proof, because an evil twin wins by broadcasting harder than the legitimate access point. When the venue posts no network name, assume nothing and ask at the counter.
What Habits Do the Agencies Recommend?
The combined advice is short enough to keep. The FTC says to use strong passwords, turn on two-factor authentication where available, and keep phones and computers updated, ideally automatically. CISA adds the network-side habits: confirm the hotspot name and password, require WPA2, deny file sharing on public networks, and guard the screen in crowded rooms. The FTC also asks people to report fraud at ReportFraud.ftc.gov. For related coverage, see Two-Factor Authentication Explained Simply: Which Method to Turn On First.
What Does Encryption Not Fix?
The lock icon checks the pipe, not the destination. The FTC warns that scammers build fake websites and encrypt them too, so a page can look secure and still be a trap; data sent there is safe from snoops but not from the site's operator. Slow down at any password prompt, read the address before typing credentials, and remember that encryption is not a review of the business behind the page.
Conclusion: Trust the Pipe, Verify the Ends
Per the FTC's 2023 advice, the public network itself is usually safe, so the old fear of every coffee-shop router can rest. The habits that matter now are concrete: verify the hotspot name, keep sharing off, use two-factor authentication, and check what sits behind the lock. The one thing the sources do not settle is VPN necessity — CISA's archived page does not rule on it, so treat that choice separately.
