Public Wi-Fi Risks

Build the mental model

Public Wi-Fi refers to any wireless network available in a shared space, such as a coffee shop, airport, hotel, or library, that you don't personally control or fully trust. Using one does not automatically put you at risk. Most traffic on the modern web travels over HTTPS, which encrypts the content of a connection so that nobody sharing the same network can read it, regardless of how much they trust that network's operator.

What actually changes on public Wi-Fi is the trust chain. On a network you control, like your home router, you are the only extra party between your device and the internet. On a public network, the operator of that network, and potentially other devices sharing it, become an additional hop your traffic passes through.

For HTTPS-protected traffic, that hop can see that a connection exists, but not its content. For traffic that isn't HTTPS-protected, or for services on your device exposed directly to the local network, such as unintentionally shared files, that extra hop matters far more.

This is why the honest risk model isn't "public Wi-Fi is dangerous," but rather "public Wi-Fi adds an untrusted party to situations where traffic or a device wasn't already protected." A banking app using HTTPS is essentially as safe on airport Wi-Fi as it is at home. A plain HTTP form submitting a password, or a laptop with file sharing left switched on, is genuinely more exposed. Recognizing which situation applies, HTTPS or not, sensitive data or not, sharing enabled or not, is the real skill worth building.

Public Wi-Fi

A wireless network available in a shared public space that you don't own, configure, or fully trust, such as one in a cafe, airport, or hotel.

PUBLIC WI-FI TRUST CHAIN
------------------------
DEVICE
  |
  v
PUBLIC WI-FI NETWORK (untrusted operator, other devices)
  |
  v  <- the extra, untrusted hop
INTERNET
  |
  v
DESTINATION (bank, email, shop site)

HTTPS encrypts the payload all the way from DEVICE to
DESTINATION. The untrusted hop can see a connection
exists, but not what is inside it.

Connect it to a real scenario

Before doing anything sensitive on a public network, glance at the address bar for the padlock and "https://". If a site or app you rely on has ever loaded over plain HTTP, that's the moment to hold off on that specific action, not to avoid the whole network. Most banking, email, and shopping apps and sites use HTTPS everywhere today, so this check rarely turns up a problem, but it's worth keeping as a habit rather than an assumption.

Turn off file sharing and AirDrop-style discovery when you're on a network you don't control; these features are built for trusted environments and quietly expose your device to everyone nearby otherwise. On a laptop, confirm the network is set to "public" rather than "private" or "home," since that setting controls how much your operating system exposes to others on the same Wi-Fi.

If you genuinely can't tell whether a connection is protected, or the activity is sensitive enough that you'd rather not take the chance, cellular data is a reasonable fallback. It routes through your carrier instead of a shared local network, removing that extra untrusted hop entirely.

• HTTPS protects the content of a connection regardless of which network carries it.
• Public Wi-Fi adds an extra, less-trusted party to the chain — for non-HTTPS traffic and exposed local services, that party matters.
• The real skill is recognizing which situation you're in, not avoiding public networks altogether.

Try the working example

function assessWifiActivityRisk({ isHTTPS, involvesSensitiveData, networkIsUntrusted }) {
  let score = 0;
  const reasons = [];

  if (!isHTTPS) {
    score += 3;
    reasons.push("Traffic is not HTTPS-encrypted, so its content could be observed on the local network.");
  } else {
    reasons.push("Traffic is HTTPS-encrypted, so its content stays protected even on an untrusted network.");
  }

  if (networkIsUntrusted) {
    score += 1;
    reasons.push("The network operator or other devices on it are an extra party in the trust chain.");
  }

  if (involvesSensitiveData && !isHTTPS) {
    score += 2;
    reasons.push("Sensitive data over a non-HTTPS connection significantly raises exposure.");
  }

  let level;
  if (score === 0) level = "low";
  else if (score <= 2) level = "moderate";
  else level = "high";

  let recommendation;
  if (level === "low") recommendation = "Proceed normally.";
  else if (level === "moderate") recommendation = "Proceed, but stay alert to the network context.";
  else recommendation = "Avoid this on this network, or switch to cellular data or a VPN.";

  return { score, level, recommendation, reasons };
}

const examples = [
  { label: "HTTPS banking app, coffee shop Wi-Fi", input: { isHTTPS: true, involvesSensitiveData: true, networkIsUntrusted: true } },
  { label: "Plain HTTP form, coffee shop Wi-Fi", input: { isHTTPS: false, involvesSensitiveData: true, networkIsUntrusted: true } },
  { label: "HTTPS news site, home Wi-Fi", input: { isHTTPS: true, involvesSensitiveData: false, networkIsUntrusted: false } },
];

for (const { label, input } of examples) {
  console.log(label, "->", assessWifiActivityRisk(input));
}

The banking-app example scores 1 (moderate) since HTTPS protects the content but the network is still untrusted. The plain-HTTP example scores 6 (high) because both the missing encryption and the sensitive data raise the score. The home-network example scores 0 (low), since HTTPS is in use and the network is already trusted.

CISA – Best Practices for Using Public Wi-Fi — Digital Privacy & Modern Security