Public WiFi Privacy: What Hackers Can See

The espresso machine hisses. Someone at the next table is on a video call, and the chalkboard by the till lists the WiFi password between the cake prices. You type it in and the little fan of bars fills. Within seconds your inbox is syncing, your messaging apps are buzzing, and a dozen background processes are reaching out to servers around the world. It feels private, just you inside your own bubble of screen and headphones. But that network is shared air, and every device in the room is breathing it.

Ask what a hacker can actually see on public WiFi and you tend to get one of two unhelpful answers. The first is panic: they can see everything, including your passwords and your bank account. The second is a shrug: it's all HTTPS now, so there's nothing to worry about. The truth sits in a more interesting middle. Once you understand it, you can work from cafés, airport lounges and hostel common rooms without turning every coffee into a security drill.

This guide covers what is genuinely exposed, what is already protected, where the real dangers lie, and a simple routine that lets you open your laptop anywhere with a clear head.

What Someone on the Same Network Can Actually See

Picture the network as a crowded room where everyone passes notes through the same messenger. With HTTPS, each note is sealed in an envelope nobody else can open, but the envelope still has writing on the outside. On most public networks, anyone using free, widely available tools can read the names of the sites you connect to. They won't see the exact page, but they will see the site itself: your bank, a job board, a clinic's booking system. That information leaks in two places. The first is DNS lookups, which on many devices still travel unencrypted. The second is a field in the opening handshake of a secure connection, called Server Name Indication, which usually names the site in plain text.

Beyond destinations, there's a surprising amount of metadata. Your device announces itself in small ways. Its hostname may include your first name. File sharing and screen mirroring features broadcast what kind of laptop or phone you're carrying. And the timing and volume of your traffic tell their own story: a large upload at the same moment each day, a long video call, a burst of activity whenever you open a particular app. None of it reveals content, but together it sketches a portrait. Modern phones and laptops use a randomised hardware address on each network, which helps. The name you gave your computer the day you set it up, though, may still be announcing itself to the whole room.

Then there's everything sent without encryption. Older websites, some smart-device apps, badly built hotel booking portals and the occasional internal work tool still send data without HTTPS. Anything travelling that way, including form entries, login cookies and the page itself, can be read by anyone in a position to capture it. It's a far smaller share of traffic than it was a decade ago, but it hasn't vanished, and it tends to turn up in places you'd never think to check.

What Stays Sealed: The Protection You Already Have

Here's the reassuring part. When the padlock appears in your browser, the contents of that page are encrypted between your device and the website's server. That covers the password you type, the message you write and the balance on your account. Someone capturing traffic on the café network sees only scrambled data. Most major sites also use a mechanism called HSTS, which tells your browser to refuse any downgrade to an insecure connection. That closes off a trick that was once a staple of public WiFi attacks. Messaging apps with end-to-end encryption add another layer: even the company running the service can't read your conversations, let alone a stranger at the next table.

That encryption is strong, but it only protects you if you're connected to the real site. The cleverest public WiFi attacks don't try to break encryption. They try to get around it, by persuading you to type your login details into a convincing copy of a real page, or to click past a certificate warning that appeared for a reason. If your browser ever says a connection isn't private on a site you use every day, that warning is the most important thing on your screen. Treat it as a closed door, not a speed bump.

Encrypted DNS is a quiet upgrade worth knowing about. Most modern browsers and operating systems can send DNS lookups over an encrypted channel, so the network can no longer read the list of sites you look up. It doesn't hide everything, because the server's IP address and often the site name in the handshake can still leak. But it narrows what's visible, and it costs nothing to switch on in your browser's privacy or security settings.

Evil Twins, Fake Portals and the Real Threats on Shared Networks

The classic public WiFi attack is the evil twin. Someone sets up a hotspot with a name that matches or mimics the venue's, such as Cafe_Guest, Cafe-Guest-Free or Airport_WiFi_Free, and waits. Your device, eager to rejoin networks it has seen before, may connect automatically. Once you're on their network, they control the path your traffic takes. They can watch your DNS requests, send you to lookalike pages, and show login screens that capture whatever you type. It sounds elaborate, but the equipment fits in a backpack and costs less than a nice dinner.

Captive portals are the splash pages that ask for your room number, email or social login before you get online, and they are the evil twin's favourite disguise. Genuine ones are clunky but harmless. Fake ones ask for more than they need: your email password, a card number for supposedly free WiFi, or an app download to 'secure your connection'. A good rule: a WiFi login page should never need the password to any of your accounts, and it should never require you to install software. If one does, disconnect and ask staff for the real network name.

Networks with a shared password carry their own quiet risk. When one password is printed on a receipt or taped to the wall, everyone who knows it is effectively inside the same locked room. On older WPA2 networks, someone on the same network can, under the right conditions, decrypt other people's wireless traffic. Newer WPA3 networks give each device its own encryption keys, which is a real improvement, but you rarely know which standard a café's router uses. Assume a shared password keeps out passers-by, not the people sitting beside you.

A Five-Minute Routine Before You Open Your Laptop

A few good habits turn public WiFi from a gamble into a non-event. Start before you even connect. Confirm the exact network name with staff or on official signage, rather than picking the most generous-sounding option in the list. Turn off auto-join for public networks you don't plan to return to. Every so often, clear out the list of saved networks on your phone, because every Airport_Free you've ever joined is a name an evil twin can borrow.

Next, put your device into public mode. On Windows, mark the network as public so the system stops advertising itself to other devices. On a Mac, switch off file sharing, set AirDrop so it isn't open to everyone, and disable any screen sharing you don't actively use. Rename your device to something generic, such as its model name rather than your full name. Then turn on a reputable VPN before you open your inbox. A VPN wraps all your traffic, including DNS lookups and site names, in an encrypted tunnel to the VPN provider, so the café network only sees that you're talking to one server. You are shifting your trust from the coffee shop to the VPN company. That's why a paid service with independent security audits beats a free app with a vague business model. For a closer look at how this works in hotels, including setup and kill-switch settings, see the guide to hotel WiFi security with a VPN.

Finally, add the account-level protections that make a stolen password far less useful. Use a password manager, which will refuse to autofill your login on a lookalike website. Turn on app-based two-factor authentication or passkeys for your email, banking and work accounts. Keep your operating system and browser updated. None of these steps takes long, and together they mean that even on a hostile network there's very little worth stealing.

How the Risk Shifts Between Airports, Hotels, Hostels and Coworking Spaces

Airports are evil-twin territory. They combine thousands of people, long waits, official networks with generic names and travellers desperate to check a gate change. Before joining, find the network name on official airport signage or the airport's website, and ask yourself whether you need the WiFi at all. Tethering to your own phone gives you a private network nobody else shares, and a local or travel eSIM keeps that affordable across borders. Our guide to eSIMs for international travel covers whether making the switch makes sense for you.

Hotels and hostels often run one shared network across dozens or hundreds of rooms, frequently on older equipment, with every guest connected to the same network. Hostel common rooms add a social twist: lots of people, lots of devices, and a culture of sharing that can extend to stray AirDrop requests and open file shares. This is where a VPN earns its keep and where switching off device discoverability matters most. If you're doing sensitive client work over a week or more, ask whether your room has a wired connection. Plugging in a cable removes the shared wireless layer entirely.

Coworking spaces usually have the safest public networks you'll find, because they're built for people working all day on confidential projects. Many give members individual logins, keep guests on a separate network and run modern routers, with staff who know what WPA3 means. That doesn't make them a private office. But if you're choosing a base for a month, network quality is worth weighing alongside the price and the coffee. This round-up of co-living spaces for affordable digital nomad housing is a useful starting point for finding places that take connectivity seriously.

Public WiFi isn't the open book it once was. Encryption now quietly protects most of what matters. What remains exposed is narrow and manageable: the names of the sites you visit, the pattern of your traffic and a device that may be announcing your name across the room. The bigger danger is not what a stranger can passively see but what they can trick you into handing over. That's why habits matter more than any single tool.

So order the flat white, confirm the network name, switch on your VPN and get to work. The hum of the café, the clatter of cups and the light through the window are the parts of working from anywhere worth paying attention to. With a few minutes of setup, the network can fade into the background where it belongs.