Public Wi-Fi safety: is public Wi-Fi safe, and when do you need a VPN?

Is public Wi-Fi safe?

Public Wi-Fi is safe enough for casual browsing if you take a few precautions, and risky for sensitive tasks if you do not. Get Cyber Safe, the Government of Canada's awareness campaign, sums it up: public networks "aren't the safest option" because anyone can connect, including people looking to steal information. The Government of Canada's travel site is stricter and says that "Public Wi-Fi networks are not secure and can be easily hacked."

That does not mean you should never use the free Wi-Fi at the library or the airport. It means you should treat it as a shared space, the way you would treat a crowded waiting room. You can sit there and read, but you would not spread your bank statements on the table.

The main risks, according to Canadian guidance

Fake hotspots ("evil twins")

Get Cyber Safe warns that criminals "sometimes create fake or "evil twin" Wi-Fi hotspots" with a name similar to the real one, set up in the same place to lure people. The Canadian Centre for Cyber Security calls these rogue access points and says they "are common in public Wi-Fi environments such as coffee shops, restaurants, airports, and public Wi-Fi locations." Connect to the fake one and the attacker sits between you and the internet.

Eavesdropping and account theft

On an unsecured network, Get Cyber Safe says, attackers can try to hack devices on the same network and "eavesdrop on Wi-Fi signals", going after personal information, login credentials and accounts. Websites that use HTTPS protect the content of your connection, which is why the padlock matters. Apps and older sites that do not use encryption leave your data readable.

Malware spreading over the network

Unsecured networks can also be used to spread malware to other connected devices, "especially if those devices aren't up to date", according to Get Cyber Safe. Updates close the holes this kind of attack relies on.

Shoulder surfing

The least technical risk is the person behind you. Get Cyber Safe reminds readers to watch for anyone looking at their screen, and the travel.gc.ca page gives the same advice about screens and keyboards.

Checklist for public Wi-Fi in Canada

These steps come from Get Cyber Safe, the Cyber Centre and travel.gc.ca. They apply anywhere, from a coffee shop on Yonge Street to a ferry terminal in Nova Scotia.

Before you connect

• Confirm the exact network name. Ask staff or check a sign posted by the business. Travel.gc.ca says to "Always confirm the name of any Wi-Fi network before connecting."
• Update your phone and laptop. Outdated devices are easier targets for malware on shared networks.
• Turn your firewall on. Get Cyber Safe advises never browsing without it, especially on public Wi-Fi.
• Set up your VPN at home first. Install the app, sign in and turn on the kill switch while you are on a network you trust.

While you are connected

• Turn the VPN on before you browse. If the network shows a sign-in or terms page first, accept it, then start the VPN.
• Look for HTTPS and the padlock on every site where you type anything.
• Keep banking and shopping for another network. Get Cyber Safe advises never using public Wi-Fi for your bank account or for purchases. If it cannot wait, switch to cellular data.
• Watch your screen and keyboard in busy places.
• Be wary of QR codes and pop-ups that ask for logins to "get online". Travel.gc.ca warns that QR codes used for menus, check-ins or Wi-Fi access can lead to phishing sites.

When you leave

• Turn Wi-Fi off if you do not need it, so your device does not join networks on its own.
• Forget the network in your settings if you will not be back.
• Log out of any account you used on a shared or public computer, and do not use "remember me" on one.

Place by place

Cafés and restaurants

Networks often have generic names, which makes a look-alike easy to set up. Ask staff for the exact name and whether there is a password. A password printed on the receipt keeps out people walking by, but every customer has it.

Airports

Airports are busy, full of people with time to kill and devices searching for networks. The Cyber Centre names airports among the places where rogue access points are common, and its VPN guidance uses airport and hotel hotspots as its example of where a consumer VPN is used. Use the airport's official network name from its signs or website, and keep the VPN on until you board.

Hotels

Hotel Wi-Fi is shared by every guest, often for days. Some hotels use a sign-in page with your room number. Complete it, then turn on the VPN. For bookings, banking or work email, cellular data or the VPN are the better route. If you are travelling outside Canada, our guide to using a VPN while travelling covers what to check before you go, including whether VPNs are allowed at your destination.

Libraries and community centres

Public library Wi-Fi may be open, without a password, and is used by a wide range of people. The OPC's 2017 blog post names the public library alongside cafés as an example of an insecure network where experts suggest a VPN. Library computers deserve extra care: log out fully and never save passwords on them.

When do you need a VPN on public Wi-Fi?

Get Cyber Safe's answer is about frequency: "If you find yourself using public Wi-Fi often, using a virtual private network (VPN) can be a safer solution." Travel.gc.ca says: "If you have to use public Wi-Fi, use your business or personal VPN." A reasonable way to apply that:

• You need one if you work from cafés, travel with a laptop, stay in hotels regularly, or sign in to email and work tools on shared networks.
• It helps less if you only check a bus schedule or a news site once in a while. HTTPS already protects most of that, and you can use cellular data for anything sensitive.

A VPN encrypts your traffic between your device and the VPN server, so other people on the café network see only scrambled data going to one address. The OPC blog post gives the example that, with a VPN, "a café owner could not determine what site you were browsing for". Our explainer What is a VPN? covers what it hides and what the VPN company can still see.

Know the limits too. The Cyber Centre writes that "a VPN does not provide security against users clicking on a malicious link or downloading malicious content." A VPN will not save you from a fake login page or a malicious QR code. The checklist above still applies.

Some public networks block VPN connections. The Cyber Centre notes that "some third-party networks restrict or block IPsec traffic". If your VPN will not connect, try a different protocol in the app's settings, or use your phone's data.

Setting it up on your phone

Your phone is the device most likely to join public Wi-Fi, often automatically. Turn off auto-join for open networks, install the VPN app before you need it, and switch on the option that starts the VPN on untrusted networks if your app has one. Step-by-step guides: VPN for iPhone and VPN for Android.

If cost is the concern, some well-known providers offer limited free plans. Our page on free VPNs in Canada explains what those plans include and their limits.

In short

Public Wi-Fi is usable with care. Confirm the network, keep devices updated, use HTTPS, leave banking for a trusted connection and turn on a VPN if you connect often. None of these steps take long once they become habit.

Compare the best VPNs for Canada

Common questions