You’re at the airport with an hour to kill, and the free Wi-Fi is right there. But is it safe to use public Wi-Fi at airports and hotels? The short answer in 2026 is: much safer than it used to be, but not risk-free — and the precautions are simple enough that there’s no reason to skip them.
The security landscape changed dramatically over the last decade. Here’s what’s actually risky now versus what’s outdated fear.
Why Public Wi-Fi Is Safer Than It Used to Be
The big change: HTTPS is now universal. In 2015, plenty of sites still sent data unencrypted, meaning anyone on the same network could snoop. Today, virtually every major site and app encrypts traffic end-to-end. Your banking app, Gmail, and social media are encrypted regardless of the network.
This means the classic “packet sniffing” attack — someone passively reading your data off the café Wi-Fi — is largely dead for mainstream sites. The Cybersecurity and Infrastructure Security Agency notes that encrypted connections have fundamentally reduced this threat.
But “largely” isn’t “entirely.” The remaining risks are real:
- Evil twin networks: an attacker sets up “Free Airport WiFi” (note the spelling) and you connect to their network. They can intercept unencrypted traffic and phish credentials.
- Unencrypted sites and apps: rare now, but some hotel captive portals and older apps still send data in the clear.
- Man-in-the-middle on logins: sophisticated, uncommon, but possible on hostile networks.
The Simple Precautions That Cover You
You don’t need to be a security expert — these five habits handle it:
- 1. Use a VPN. This is the big one. A reputable VPN ($3–$10/month) encrypts everything leaving your device, making the network itself irrelevant. Learn about VPNs if you haven’t set one up — on public Wi-Fi, it’s the single highest-value protection.
- 2. Verify the network name. Ask staff for the exact Wi-Fi name. “Hotel_WiFi” vs “Hotel_WiFi_Free” — connect to the wrong one and you’re on an attacker’s network.
- 3. Keep 2FA on everything — set it up with an authenticator app. Even if someone grabs a password, they can’t get in.
- 4. Avoid sensitive transactions if you can. Banking on hotel Wi-Fi with a VPN: fine. Banking on “Free WiFi!!!” without one: wait until you’re home.
- 5. Turn off auto-connect to open networks in your phone’s Wi-Fi settings — otherwise your phone joins hostile networks silently.
- 6. Forget the network afterward so your phone doesn’t auto-join it (or an evil twin impersonating it) next time.
What About Hotel Wi-Fi Specifically?
Hotel networks deserve extra caution for two reasons: they often have captive portals (the “accept terms” page) that briefly handle your traffic unencrypted, and hotel networks are notoriously poorly secured — sometimes every room shares one flat network where devices can see each other.
On hotel Wi-Fi specifically:
- Use your phone’s hotspot instead when possible — cellular data is inherently more secure than shared Wi-Fi.
- If you must use hotel Wi-Fi for work, VPN is non-negotiable.
- For streaming on the hotel TV, download content beforehand rather than streaming over hotel Wi-Fi — it’s both safer and more reliable.
- Turn on your firewall (it’s on by default on Mac and Windows — just don’t turn it off).
The Bottom Line on Risk
Let’s be realistic about threat models. If you’re checking email and reading news at the airport, HTTPS plus basic caution is plenty — the realistic risk is near zero. If you’re doing banking, accessing work systems, or handling sensitive business, use a VPN or your phone’s hotspot.
The people who get burned on public Wi-Fi in 2026 aren’t victims of sophisticated hacking — they’re victims of evil-twin networks and phishing on the captive portal page. Verify the network name, use a VPN, and you’re covered against everything plausible.
Hotel Wi-Fi Captive Portals: The Security Risk Nobody Mentions
Before you reach the internet at most hotels, you pass through a captive portal — the “accept terms” page. Here’s the problem: to show you that page, the network intercepts your first web request, which means your initial traffic passes through the hotel’s systems unencrypted. It’s brief, but it’s a genuine man-in-the-middle position.
The practical risks are modest — modern browsers and apps use HTTPS, so the portal sees connection attempts, not content. But never enter sensitive credentials on the portal page itself, and be wary of portals asking for more than a room number or simple acceptance. A portal requesting your email, social login, or payment details deserves skepticity — verify it’s the hotel’s legitimate page, not an evil twin.
Best practice: connect, accept the portal with minimal information, then immediately enable your VPN before doing anything else. The VPN encrypts everything from that point forward, closing the exposure window.
Frequently Asked Questions
What is an evil twin attack?
An attacker broadcasts a Wi-Fi network with a name nearly identical to the legitimate one (‘Hotel_WiFi_Free’ vs ‘Hotel_WiFi’). You connect to the attacker’s network, giving them a position to intercept traffic and phish credentials. Always verify the exact network name with staff.
Is hotel Wi-Fi safe for work email?
With a VPN, yes — the encryption protects your traffic from the local network. Without one, you’re relying on each app’s individual encryption. For sensitive work, VPN or phone hotspot; for casual browsing, standard caution suffices.
Should I do online banking on hotel Wi-Fi?
Prefer your phone’s cellular data or hotspot for banking. If you must use hotel Wi-Fi, ensure the VPN is on and the bank’s app/website shows HTTPS. Never bank on a network you haven’t verified as legitimate.
Do VPNs slow down hotel Wi-Fi further?
Slightly — encryption overhead plus the VPN server’s distance typically costs 10–20% of speed. On already-slow hotel Wi-Fi this can matter for video. For security-sensitive tasks, accept the slowdown; for streaming, consider downloaded content instead.
Can the hotel see what websites I visit?
Without a VPN, yes — DNS requests and IP destinations are visible (though page content is HTTPS-encrypted). With a VPN, they see only encrypted traffic to one server. If this bothers you, VPN always on hotel networks.
Is the ‘free VPN’ from my antivirus good enough?
Usually yes for hotel use — reputable antivirus-bundled VPNs (Norton, Bitdefender) provide real encryption. Avoid random free standalone VPN apps with no clear business model; they may log and sell your data.
Key Takeaways
Public Wi-Fi is much safer than its reputation suggests, thanks to universal HTTPS encryption — but evil-twin networks and unencrypted portals remain real risks. Verify the exact network name, run a VPN, keep 2FA on, and prefer your phone’s hotspot for anything sensitive. Five minutes of setup, and airport Wi-Fi becomes a non-issue.
