Public Wi-Fi: What Actually Happens to Your Data When You Connect

What Happens the Moment You Connect

When your device joins a public Wi-Fi network, it becomes part of a shared local network with every other connected device in that space. Your data travels wirelessly to the router, then out to the internet — and on the way, it passes through infrastructure that the venue controls, not you.

At the network level, most public hotspots use little or no encryption between your device and the router. That means another user on the same network, using freely available software, could potentially intercept packets of data travelling across it. This technique — broadly called packet sniffing — is a well-documented method for capturing unencrypted network traffic.

The good news is that the web has changed significantly. The widespread adoption of HTTPS (Hypertext Transfer Protocol Secure) means that the content of most web pages, login forms, and app communications is encrypted end-to-end. A snooper might be able to see that you visited a particular site; they generally cannot read what you typed or viewed there. But "most" is not "all" — older sites, some apps, and certain background services still communicate in the clear.

The Risks That Still Exist

Even in a world of HTTPS, public Wi-Fi carries real risks that go beyond passive eavesdropping.

Evil Twin Hotspots

One of the more deceptive threats is the evil twin attack. An attacker sets up a rogue hotspot with a name nearly identical to a legitimate one — say, "CafeWifi" instead of "Cafe_Wifi". Devices that auto-connect, or users who don't verify the network name, may hand over all their traffic to the attacker. Always confirm the correct network name with staff, and disable auto-connect on your device for unfamiliar networks.

Man-in-the-Middle Attacks

A more sophisticated threat involves an attacker positioning themselves between your device and the internet, intercepting and potentially altering communications. While HTTPS significantly complicates this, it is not a complete guarantee — especially on misconfigured networks or when a user clicks through certificate warnings.

Network-Level Data Collection

The operator of the Wi-Fi network — whether a coffee shop or a third-party hotspot provider — can log metadata about your session: which sites you visited, when, and for how long. This is legal in most cases and disclosed in terms of service that most people skip. It's worth being aware that "free" connectivity sometimes comes at the cost of browsing data.

For a broader look at digital risks when you're away from home, the guide to keeping devices safe while traveling covers public Wi-Fi alongside other travel-specific concerns.

Practical Steps That Actually Reduce Your Risk

You don't need to avoid public Wi-Fi entirely — but calibrating how you use it makes a meaningful difference.

• Use HTTPS sites only. Look for the padlock icon in your browser's address bar. Most modern browsers will warn you before loading an unencrypted page.
• Consider a VPN for sensitive sessions. A VPN encrypts traffic between your device and a server before it reaches the public network. Our VPN explainer covers what this protection actually includes — and where its limits are.
• Avoid banking and payment transactions. Save these for your home network or cellular connection. The stakes are high enough that the inconvenience is worthwhile.
• Turn off auto-connect. Prevent your device from silently joining known network names without your confirmation.
• Use mobile data as an alternative. If you need to do something sensitive and you have sufficient data, your cellular connection is generally more secure. Comparing your options is worth understanding — see mobile hotspot vs. home broadband for context on when each makes sense.

Building these into everyday habits matters more than any single precaution. The guide to building safer digital habits offers a practical framework for making security second nature.

How Public Wi-Fi Differs From Your Home Network

At home, your router typically uses WPA2 or WPA3 encryption between devices and the router — a level of protection most public hotspots don't offer. You also control who's on the network, reducing exposure to untrusted devices. Public networks, by contrast, may have dozens or hundreds of unknown users connected simultaneously.

This distinction matters for understanding risk, not for avoiding public Wi-Fi altogether. Most everyday browsing — reading articles, streaming video, checking social media — involves relatively low stakes even on a shared network, particularly over HTTPS. The risk calculus shifts when credentials, payment data, or sensitive communications are involved.

For a deeper look at how home networking and routers function compared to open access points, a guide to what your router actually does provides useful grounding. And if you're interested in how the underlying connection compares between wired and wireless setups at home, wired vs. Wi-Fi at home explains where those differences show up in practice.