Is public Wi-Fi actually dangerous?

For years the advice was simple: never use public Wi-Fi without a VPN, or someone two tables away will read your emails. That was true once. It is mostly not true now, and pretending otherwise is the kind of scaremongering that makes people ignore the parts that still matter.

What changed

Almost every site now uses HTTPS. The padlock means the connection between your browser and that site is encrypted end to end, so the café network cannot read what you send. The classic "packet sniffing in a coffee shop" attack mostly died with it.

What did not change

The network still sees where you go. Not the contents, but the domain names. Whoever runs that network — or has quietly joined it — can build a list of every service you used.

Fake networks still work. Anyone can name an access point Airport_Free_WiFi. Connect to it and they control your DNS, which means they decide where yourbank.com actually points. HTTPS warns you if they get it wrong, but people click through warnings.

Captive portals are a mess. The sign-in page a hotel shows you is often plain HTTP, and people routinely type real personal details into them.

Old and odd devices lag behind. Your laptop is probably fine. A cheap smart device, an old tablet, a games console with a forgotten browser — less so.

What a VPN actually changes here

It moves the trust. Instead of trusting the café, the hotel and whoever else is on that network, you trust one encrypted tunnel to a server you chose. The local network sees an encrypted connection to one address and nothing else — no domains, no DNS, no pattern of use.

That is a real and worthwhile improvement. It is not the same as being safe from everything.

The short version

Public Wi-Fi is not the death trap it was described as in 2012, and a VPN is not a magic shield. But on a network you do not control, run by people you cannot identify, shared with strangers, it removes an entire category of problem for the cost of switching one thing on.