How to Protect Your Data on Public Wi-Fi
Open networks in cafes, airports, hotels and coworking spaces are convenient, but by default they don't verify who's connecting and often don't encrypt the channel between your device and the access point. Where does this risk come from, how do WPA2 and WPA3 differ, and what can you do in a few minutes to reduce it?
Because of this, data traveling over such a network in the clear is, in principle, available for interception by anyone else on the same network. Below: where this risk comes from, how WPA2 and WPA3 differ, and what you can do in a few minutes to reduce it.
Why public Wi-Fi is a category of risk on its own
A home or office network usually has one known owner and a password that isn't handed out to strangers. In a cafe or an airport, dozens of unfamiliar devices connect to the same access point at once, and the access point itself could have been set up by anyone. That leads to three common scenarios:
- Traffic interception (packet sniffing). If the network is open or uses a password shared by everyone with no additional session-level encryption, any other participant on that network can technically analyze someone else's traffic with the right tools.
- Rogue access points. An attacker sets up their own network with a similar name — say, "Free_Airport_Wifi" instead of the venue's official name — and routes all of the connected devices' traffic through themselves.
- Man-in-the-middle (MITM) attacks. An attacker's device positions itself between you and the real access point and can alter the content of unencrypted pages or redirect you to fake login forms.
None of these scenarios requires the attacker to have any special access to the venue's own equipment — being on the same public network is enough.
WPA2 vs. WPA3: what changed for shared networks
WPA2 has been the Wi-Fi standard for years, but it has limitations specifically in the context of shared networks: the password is the same for everyone, which means that, given favorable conditions for capturing the handshake, someone who knows it could in theory attempt to decrypt other people's traffic on the same network. WPA3 closes part of that gap — according to a technical report from the U.S. National Security Agency (NSA) on WPA3, the new standard uses the SAE protocol instead of WPA2's key exchange, which makes offline password guessing harder, and adds forward secrecy: each session gets its own unique key, so a password compromised later can't be used to decrypt traffic captured earlier. A separate WPA3 feature, Enhanced Open (OWE), encrypts the channel between a device and the access point even on fully open networks with no password at all — something WPA2 simply couldn't do.
An important caveat: many public routers in cafes and hotels still run WPA2 or no encryption at all, and support for Enhanced Open is rolling out unevenly across access-point vendors. So you shouldn't rely solely on the network's own encryption standard — the steps below work regardless of which Wi-Fi standard a given venue happens to use.
Checklist: what to do before and during a connection
Each item takes less than five minutes and doesn't require any special knowledge.
- Turn off auto-connect to open networks. Your phone's and laptop's Wi-Fi settings have an option like "connect to open networks automatically" — turn it off so your device doesn't latch onto random access points without your knowledge.
- Confirm the exact network name with staff. Rogue access points are often named almost identically to the real one, with a small typo or an extra word added.
- Turn off file and folder sharing. While you're on a public network, disable file sharing, printer sharing and AirDrop/"nearby share" — these features are meant for trusted networks.
- Check for HTTPS. The padlock icon and an https:// address mean the content of that specific page is encrypted between your browser and the site, but that doesn't protect the network itself — the connection can still be analyzed at the metadata level, and DNS requests can still be intercepted or spoofed.
- Use an encrypted tunnel for all of your device's traffic, not just the browser — more on this in the next section.
- Turn on two-factor authentication for key accounts. If a password does get intercepted or is captured through a phishing form, the second factor stops anyone from logging into your account from another device.
- "Forget" the network after you're done. This stops your device from automatically reconnecting to it the next time you're nearby.
How traffic encryption complements network security
Even if the access point itself uses an outdated standard or doesn't encrypt the channel at all, you can still fix the situation at the device level. An app that establishes an encrypted tunnel between your device and a remote server wraps all of your traffic in that tunnel — not just your browser's, but every other app's too. To an outside observer on the same public network, all that's visible is an encrypted stream of data, with no way to read its contents or tamper with it in transit. For a closer technical look at how traffic encryption works, see a separate piece — "What internet traffic encryption actually is, in plain terms".
In practice, that means keeping an app on hand that encrypts your connection and turns on with a single tap in settings is a smart habit for dealing with unfamiliar networks. HamikVPN is one such tool: it encrypts the connection on your phone and computer and connects in one tap; apps for various platforms are available on the download page.
A note on Android
On Android 10 and above, the system uses a randomized MAC address for each saved network by default — as described in the official Android Open Source Project documentation. Randomization makes it harder to track the same device across different public networks, but it doesn't protect the contents of your traffic — that's a separate job handled by encryption at the app level, not by the network adapter's identifier. A fuller list of settings for everyday Android protection is in our Android security checklist, and the requirements and features of a mobile VPN app for Android are covered on a dedicated page.
What else is worth checking
Public Wi-Fi is just one of the channels through which personal data can leak. It's worth also checking in on general digital-hygiene practices: use different passwords for different services, store them in a password manager rather than in notes, and enable two-factor authentication — why it matters and how to set it up is covered in our piece on two-factor authentication. If you travel often, it's worth keeping a broader checklist on hand too — for example, our quick travel security checklist.