The advice "never type a password on public WiFi" is one of security's most durable hand-me-downs - And it's about fifteen years out of date. In 2010, a Firefox extension called Firesheep let anyone in a coffee shop hijack the Facebook and Twitter sessions of everyone else on the network with one click, because most sites sent logins and cookies in cleartext. That demonstration shamed the web into encrypting itself.
Today the picture is inverted. Google's transparency reporting has HTTPS carrying well over 95% of Chrome page loads, so your password is encrypted before it leaves your laptop, and the person sniffing airport WiFi sees ciphertext. But "mostly fixed" isn't "fixed." The attacks that still work on public networks have shifted from passive listening to active deception - And they're worth understanding precisely, because the real defenses aren't the ones in the hand-me-down advice.
What an eavesdropper actually sees now
When you log in to any modern site, TLS encrypts the traffic end to end between your browser and the server - Our plain-English tour of HTTPS and TLS covers the handshake. Someone capturing WiFi packets gets the metadata: which domains you visit (via DNS and the server name in the TLS handshake), when, and how much data moved. Revealing, sure. But not your password, not your session cookies, not page contents.
That single fact retires most of the folklore. What it does not retire are attacks where the network stops passively listening and starts actively lying to you.
The threats that still work in 2026
| Threat | How it works | What defeats it |
|---|---|---|
| Evil twin hotspot | Attacker broadcasts "Airport_Free_WiFi"; your device joins the stronger signal | HTTPS still protects logins; distrust of look-alike networks; VPN |
| Fake captive portal | The hotspot's "login page" asks for your email password or card details | Never enter real account credentials on a WiFi portal |
| DNS manipulation | Hostile network answers DNS with attacker IPs | Certificate warnings - Heed them; encrypted DNS |
| TLS-stripping / downgrade | Forcing a rare plain-HTTP connection on legacy sites | Browser "HTTPS-only" mode; HSTS on the site's side |
| Open-network metadata | Passive logging of the sites you visit | VPN or encrypted DNS if it matters to you |
Evil twins are the workhorse. Anyone with a $30 device can broadcast a network named after the venue, and your phone will happily join whichever signal is strongest. The twist most people miss: joining a hostile network still doesn't expose HTTPS-protected passwords. What it enables is everything else on this list - The attacker now controls DNS, the portal page and every unencrypted scrap.
Fake captive portals are where credentials actually get stolen. The network pops a "sign in to continue" page asking you to log in with Google, or register with your email address and a password. It's a phishing page with a WiFi costume - The same psychology dissected in our phishing protection guide. Nobody sniffs your password; you type it into the attacker's form.
Certificate warnings are your tripwire for the rest. If a network tries to impersonate your bank's site, TLS makes the browser scream - An invalid-certificate interstitial. On public WiFi, "proceed anyway" is never the right button.
On modern networks, your password is rarely stolen from the air - It's handed over to a convincing fake page. The defense isn't avoiding WiFi; it's refusing to type real credentials into pages the network showed you.
What a VPN does and doesn't fix
A VPN wraps all your traffic in an encrypted tunnel to the VPN provider, which neutralizes hostile-network tricks: the evil twin sees only tunnel ciphertext, can't tamper with DNS, and learns nothing about your destinations. On networks you don't trust, that's genuinely valuable.
What a VPN cannot do is stop you from typing your password into a phishing page - The page loads fine through the tunnel - And it doesn't add meaningful password protection on sites already using HTTPS, which is nearly all of them. It also relocates trust rather than eliminating it: the VPN operator now sits where the coffee shop did. Useful tool, wrong tier for password security.
The protections that actually decide whether a stolen or phished password matters are account-level. Two-factor authentication turns a phished password into a failed login for most attackers, and unique per-site passwords cap the damage at one account. Messaging apps with end-to-end encryption go a step further - Content stays sealed even if every network between you and the recipient is hostile.
Your router is someone else's public WiFi
The flip side of this topic gets skipped: your home or small-office network is "public WiFi" to anyone in radio range if the password is weak. WiFi passwords are unusually crackable because an attacker can capture the WPA2 handshake once and then run offline guesses against it at massive speed, from a parked car or a week later. Short or dictionary-based WiFi keys fall to this routinely.
The fix costs nothing: WPA2 or ideally WPA3 (whose SAE handshake specifically blunts offline guessing), with a long random key - Our WiFi password generator produces 20+ character keys you'll only ever type once per device. Modern WiFi encryption rides on the same AES cipher trusted for classified data; you can poke at how it scrambles data with our AES-256 tool. While you're in the router admin panel, change the admin password too - It's a separate credential, and the factory default is in every attacker's playbook.
FAQ
Can someone on the same WiFi see my passwords?
Not for any site using HTTPS - The password is encrypted on your device before transmission, and the eavesdropper sees ciphertext. What same-network attackers can see is which sites you visit, and what they can do is impersonate the network itself. The danger isn't the login you send; it's the fake page you might send it to.
Is it safe to do online banking on public WiFi?
Safer than the folklore suggests: banking sites use HTTPS with HSTS, so the connection itself is robust even on hostile networks. The residual risks are fake portals, certificate-warning click-through and shoulder surfers. If a banking session can wait, use your phone's cellular hotspot - Cellular removes the hostile-LAN problem entirely.
Should I use the WiFi password the café posts on the wall?
Yes - A posted WPA2 password is still better than an open network, because traffic is encrypted over the air even though other patrons share the key. Just match the network name exactly against what staff posted; evil twins rely on plausible variants. And treat the network as untrusted regardless: shared-key WiFi authenticates the network to you only weakly.
Does public WiFi explain how my account got hacked?
Almost never. When accounts fall, the cause is overwhelmingly a reused password from a data breach, a phished login, or malware - Not packet sniffing at a café. Public WiFi makes a satisfying villain because it feels exposed, but the boring explanations dominate the statistics.
Are hotel and airport networks with login pages safer?
The login page mostly exists for liability and marketing, not security - Many such networks are open underneath, and the portal proves nothing about who else is on it. Treat them exactly like any open network: fine for HTTPS browsing, never worth typing a real account password into the portal itself.