Public Wi-Fi Got Safer. Here's Where the Risk Still Is

On September 22, 2026, Google released Chrome 154, which makes the desktop browser ask before connecting to a site over unencrypted HTTP by default. Google says the prompt is meant for public sites you haven't visited recently. Most web traffic was already encrypted. For anyone on airport, hotel or café Wi-Fi, that means passive snooping, the risk most warnings describe, is now a small part of the problem. The bigger risk is being tricked. In Australia, a man who ran fake airport and in-flight Wi-Fi networks to collect people's logins, then used them to break into women's online accounts, was sentenced in November 2025 to seven years and four months in prison after pleading guilty.

Key takeaways

For everyday browsing, public Wi-Fi is safer than its reputation. The FTC's consumer page, dated February 2023, says connecting through public Wi-Fi is "usually safe" because most websites use encryption.
Encryption protects what you send to a real site. It doesn't help if you type a password into a fake sign-in page, and the fake page can show a lock icon too.
Someone on the same network can usually still see which sites you visit, even on HTTPS. Site names show up in DNS lookups and in the TLS handshake.
Saved networks are a large part of the remaining risk. In the Australian case, devices connected automatically to fake networks that copied the names they were looking for.
Stricter advice still stands for some readers. NSA's guidance for government and defense teleworkers says to avoid public Wi-Fi when possible, never use open hotspots, and avoid banking or shopping on public networks.
A VPN hides your traffic from the local network but moves your trust to the VPN company. It does nothing to protect what you type into a fake sign-in page.

What it means for you

Travelers in airports, hotels and on flights: fake networks and fake sign-in pages are the main risk. Check the network name with staff and never give an email or social media login just to get online. See "Where the risk still sits."
Remote workers: NSA's guidance for government and defense teleworkers is stricter than consumer advice. It prefers a personal or work hotspot and says to use a VPN if public Wi-Fi can't be avoided. Your employer's rules take precedence. See "When a VPN helps, and when not."
Banking or shopping: a real banking site or app on HTTPS keeps your password and balances away from other people on the network. But an onlooker can still see that you visited your bank. Consumer advice from the FTC treats this as usually safe. NSA's sheet for its teleworkers and CISA's archived travel advice say to avoid banking and shopping on public Wi-Fi, and the AFP's advice after the Australian case says not to bank online on it. Using your phone's cellular data takes the Wi-Fi network out of the picture. See the table in "What a stranger on the network sees."
Older phones and laptops: devices that no longer get updates miss fixes for Wi-Fi flaws, and older apps may still send unencrypted data. Use them on public networks only for low-stakes browsing. See "Apps and devices you can't inspect."

Why official advice differs

Some of the advice people remember comes from years when most sites were unencrypted. Age alone doesn't explain the gap, though. NSA and CISA published their cautious advice in 2021, after HTTPS was already common. The bigger difference is who the advice is for and how much risk they can accept. The table below shows what each source says, when it was published and who it was written for, checked on October 4, 2026.

Source	Published	Written for	Core advice
FTC consumer advice	February 2023	General public	Public Wi-Fi is usually safe because most sites and apps encrypt data. Look for HTTPS, keep software updated and watch for scam sites.
NSA, Securing Wireless Devices in Public Settings	July 2021	National security, defense and defense-contractor teleworkers. The press release also refers to personal data.	Avoid public Wi-Fi when possible and use a hotspot instead. Don't connect to open hotspots, and avoid bank accounts and shopping on public Wi-Fi. If you must connect, use a VPN, turn off auto-connect and forget the network afterward.
CISA travel blog	February 2021, now in CISA's archive	General public	Don't bank or shop on open Wi-Fi. Use cellular data instead.
Cybersecurity While Traveling tip card (Stop.Think.Connect., hosted by CISA)	About 2015 (per the file's metadata)	Travelers	Confirm the network name and login steps with staff, and turn off auto-connect. Don't shop, bank or do sensitive work on public wireless networks.

The two views fit together once you separate two kinds of risk. Snooping on traffic as it passes is mostly solved by encryption. Being steered to the wrong network or the wrong page is not. The NSA sheet itself recommends HTTPS, and the FTC page itself warns that scammers build fake sites that are encrypted. NSA's July 29, 2021 announcement says the guidance is meant to help users "make calculated decisions about the level of risk they accept." At a minimum, it recommends turning off Wi-Fi, Bluetooth and NFC when they aren't in use. Someone handling sensitive work or accounts can reasonably choose the stricter path.

The encryption numbers come from Google's own Chrome data, so they are company figures rather than independent ones. In its October 2025 announcement, the Chrome security team said HTTPS page loads rose from about 30 to 45 percent in 2015 to a 95 to 99 percent range by around 2020, then leveled off. Counting only public sites, Windows was at 98 percent and Android and Mac above 99 percent. Chrome 154 now asks before opening a site without HTTPS if you haven't visited it recently. It doesn't keep warning about a site you visit regularly. Google said it would enable the version that skips private addresses such as home routers. ChromeStatus lists desktop Chrome 154 and Android Chrome 155, and no iOS version. Google's Chromium Dash schedule puts Chrome 155 stable on October 6, 2026.

Network standards are changing too. The Wi-Fi Alliance's Wi-Fi Enhanced Open encrypts traffic on password-free networks when both the network and the device support it. But the Alliance describes that encryption as "unauthenticated." The underlying specification, RFC 8110, says it provides no authentication and that an attacker can impersonate an access point. It scrambles the radio link but doesn't prove the network is the one it claims to be.

What a stranger on the network sees

The table assumes someone on the same public network who can watch traffic or runs the hotspot itself, which is what an evil twin does. An evil twin is a fake network set up with the same name as a real one.

What could be exposed	Banking site or app over HTTPS	Site over plain HTTP	Fake Wi-Fi sign-in page
Which site you visit	Usually yes, through DNS lookups and the site name sent at connection setup	Yes, including the full page address	Yes. The attacker made the page.
Passwords, balances, messages	No	Yes	Anything you type in
Can the page be altered?	No. Tampering triggers a browser error.	Yes, silently	The attacker writes the whole page
When you connect and how much data moves	Yes	Yes	Yes
With a VPN running	Site names and traffic are hidden from the local network	Protected on the local network, but still unencrypted after it leaves the VPN server	No help. You give the data away yourself, and a VPN typically can't connect until a Wi-Fi sign-in page is completed.

The first row surprises most people. HTTPS hides the content but not the destination. The standards body behind TLS, the encryption used for HTTPS, notes in RFC 9849 (March 2026) that the site name sent at the start of a connection "leaks the target domain." Plain DNS lookups and server IP addresses can reveal it too. Encrypted Client Hello, the fix described in that RFC, works only when both the browser and the site support it. Even then, it doesn't hide plain DNS lookups or the server's IP address.

Illustrative example. A traveler with a Windows laptop loads 200 web pages in a browser over a week of airport and hotel Wi-Fi. If their browsing matched Google's 98 percent HTTPS figure for public sites on Windows, 200 × 0.02 = 4 of those page loads would travel unencrypted. At 95 percent, the figure is 200 × 0.05 = 10. Those are the browser pages whose content an onlooker could read or change. Site names would still show for the rest, and some app traffic may be readable too. On desktop Chrome 154, the traveler is asked before opening any of those pages that belong to a public site they haven't visited recently. A single fake sign-in page, by contrast, can collect a full email password in one step. In this example, being fooled once can expose more than a week of passive snooping on browser pages.

Where the risk still sits

Look-alike networks and sign-in pages

The Australian Federal Police describe how the 2024 attacks worked. A portable device picked up the network names nearby phones and laptops were searching for, broadcast a network with the same name, and devices joined it automatically. People then saw a page asking them to sign in with an email or social media account. That page saved what they typed and gave them no internet connection. The investigation began after airline staff noticed a suspicious network mimicking the real one during a domestic flight.

The AFP's advice is to avoid any network that asks for personal details such as an email or social media login. A real venue may ask for a room number, a last name or acceptance of terms. It has no reason to ask for your Google or Facebook password. The CISA-hosted travel tip card adds another step: confirm the exact network name and login steps with staff before you connect.

Auto-join and saved networks

Phones rejoin networks they have used before. Android marks a joined network as "Saved" and connects automatically when it's in range. Apple devices auto-join known networks unless you forget the network or turn off Auto-Join for it. A password-free network you once used at an airport is easy to copy, because the copy only needs the same name. NSA's checklist says to turn off auto-connect, forget the network when you finish, and delete networks you no longer use.

Sharing settings left open

On a shared network, other devices can try to reach yours. Windows 11 sets new networks to Public by default, which hides the PC from other devices and blocks file and printer sharing. Switching a café network to Private turns that protection off. On iPhone, the AirDrop setting Everyone for 10 Minutes switches back to Contacts Only after 10 minutes in iOS 16.2 and later, or to Receiving Off if you aren't signed in to an Apple Account. NSA also advises laptop users to turn off file and printer sharing on public networks.

Apps and devices you can't inspect

Browsers show a lock icon, but apps don't. The FTC says it can be hard to tell whether a mobile app uses encryption, though most do. On Android, apps built for Android 9 or later block unencrypted HTTP by default. Developers can turn it back on, and older apps allowed it by default. Device updates matter too. The FragAttacks flaws, disclosed in May 2021, affected every Wi-Fi product the researcher tested and were fixed through coordinated security updates. A phone or laptop that no longer gets updates may never receive fixes like those.

DNS answers and certificate warnings

Whoever runs a hotspot usually controls its DNS, the service that turns a site name into an address. RFC 9849 calls injected or poisoned DNS answers "a common scenario in client access networks." A forged answer can quietly send an HTTP site somewhere else. For an HTTPS site, standard certificate checks mean it should trigger a full-page "Your connection is not private" error, which Chrome's help page says can mean a problem with the site, the network or your device. On public Wi-Fi, close the page and don't click through.

When a VPN helps, and when not

A VPN, or virtual private network, sends your device's traffic through an encrypted tunnel to the VPN company's servers. The FTC's 2018 guidance on VPN apps says that someone watching an unsecured Wi-Fi network then sees only scrambled data, even for sites that don't use encryption themselves. That helps with plain HTTP sites, apps you can't check, and hiding site names from the local network. NSA strongly advises a VPN for its teleworkers whenever they use public Wi-Fi, and the AFP recommends a reputable one.

The same FTC guidance lists the trade-offs. A VPN shifts trust from the Wi-Fi provider to the VPN provider, which can then see your traffic. Some VPN apps don't encrypt everything, some ask for sensitive permissions, and many free ones make money from ads or by sharing data with third parties. A VPN also doesn't make you anonymous. And it can't stop phishing. If you type a password into a fake sign-in page, the VPN only carries it to the wrong place more privately.

For a single sensitive task, there's a simpler option. CISA's travel advice is to switch off Wi-Fi and use cellular data for banking or purchases, and NSA prefers a personal hotspot with strong encryption over public Wi-Fi.

Frequently asked questions

Is hotel Wi-Fi with a password or room-number login private?

Not necessarily. NSA notes that a password-protected public network might not encrypt traffic at all. If it does, anyone who knows the shared password can decrypt what others send. Treat hotel Wi-Fi as public no matter what login it uses.

Can a fake network really appear on a plane?

Yes. In the Australian case, airline staff spotted a suspicious network mimicking the real in-flight service during a domestic flight, and that report started the police investigation. One sign was that signing in to the fake portal never actually gave internet access. If a sign-in page takes your details and nothing connects, assume the details are compromised.

What should I do if I typed a password into a suspicious Wi-Fi page?

Disconnect, then use a trusted connection to change that account's password. The FTC's steps for compromised accounts also include signing out of all devices, turning on two-factor authentication and checking that the recovery email and phone number are still yours. Its account recovery page links to each major provider's recovery process.

Does Apple's Private Wi-Fi Address setting protect my data?

It protects your privacy, not the content of your traffic. Apple says the feature gives your device a different hardware address on each network, so network operators can't easily track it from place to place over time. It doesn't encrypt anything, so it doesn't replace HTTPS or a VPN.

Should Bluetooth be off in public places?

NSA and CISA both advise turning Bluetooth off when you aren't using it. CISA warns that criminals can try to pair with a phone whose Bluetooth is left open. If you keep it on for earbuds or a watch, NSA's guidance is to reject any pairing request you didn't start and keep the device out of discoverable mode.

Settings to change before you go

Install pending updates for your phone, laptop and browser before you travel. On desktop Chrome, check that you're on version 154 or later.
Open your saved Wi-Fi list and forget old airport, hotel and café networks. On Apple devices, you can instead turn off Auto-Join for any you want to keep.
Confirm the network name and sign-in steps with staff. Leave any sign-in page that asks for an email or social media password.
Keep Windows networks set to Public. Set AirDrop to Contacts Only or Receiving Off, and turn off file sharing on laptops.
For banking, payments or work logins, switch to cellular data or your phone's hotspot. Or use a VPN from a provider you have researched, or the one your employer provides.
Never click past a "Your connection is not private" warning on public Wi-Fi.
Forget the network when you leave.

This article is general information for consumers, not a security assessment of any particular device, account or network.