Quick answer: public Wi-Fi in 2026 is far safer than the old advice suggests — HTTPS now encrypts almost everything you do — but three real risks remain: fake hotspots (evil twins), captive portals that harvest personal data, and what your own device shares on the local network. Here is what actually matters, and what you can stop worrying about.
Myth vs reality in 2026
| Claim | Verdict | Why |
|---|---|---|
| “Hackers can read everything you do on cafe Wi-Fi” | Mostly myth | 95%+ of web traffic is HTTPS-encrypted end to end |
| “Fake hotspots can trick your phone” | Real risk | An “evil twin” network with the same name can capture logins on badly built apps |
| “Captive portals are harmless” | Partly myth | Many harvest emails and browsing habits for marketing — read what you agree to |
| “You need a VPN for everything” | Overblown | Useful on open networks and for privacy, but HTTPS already covers banking and shopping |
| “File sharing settings do not matter” | Myth | Network discovery + old SMB shares are the main way laptops leak on public networks |
The three real risks — and the fix for each
1. Evil twin hotspots. Anyone can broadcast a network called “Airport_Free_WiFi”. Fix: ask staff for the exact network name, and turn off auto-join for public networks so your phone does not reconnect to an imposter later. 2. Data-harvesting portals. That login page asking for your email, birthday and phone number is building a marketing profile. Fix: use an alias email address and never reuse a real password on a portal. 3. Your own device’s sharing settings. Fix: mark public networks as “Public” when Windows asks (this disables network discovery and file sharing), and keep AirDrop set to Contacts Only on iPhone.
When you should still use a VPN
A VPN is worth it on open (passwordless) networks, when you travel and hit unfamiliar networks daily, and when you do not want the network operator logging which sites you visit. It is not a magic shield: it cannot stop phishing, malware or a fake login page. If your laptop has been acting strange since a trip, run through our guide to the signs your computer has malware — and if you have ever typed a password into a dodgy portal, check whether that account appears in a known breach in our data breach response guide.
Bottom line: verify the network name, treat portals as marketing traps, set your device to Public, and save the VPN for open networks. That covers 99% of real-world risk in 2026.
