What can hackers see when I use public WiFi?

On unencrypted public WiFi without a VPN, an attacker can see: every website domain you visit (even HTTPS sites reveal the domain name), specific pages on non-HTTPS sites, any usernames/passwords entered on HTTP sites, and your device's MAC address and hostname. They cannot see the content of HTTPS-encrypted pages, but they CAN see which sites you are visiting. With freely available packet sniffers like Wireshark, an attacker can monitor all unencrypted traffic in real time.

What is an evil twin WiFi attack?

An evil twin attack is when a hacker creates a fake WiFi hotspot with the same name (SSID) as a legitimate one, often with a stronger signal to trick your device into connecting. Once connected, the attacker can intercept all your traffic, capture login credentials, inject malware, and strip HTTPS encryption. Evil twins are common at airports and hotels. Always verify the exact network name with staff before connecting, and use a VPN to encrypt all traffic even on a malicious network.

Can I safely check my bank account on public WiFi?

Without a VPN: No. Even with HTTPS, sophisticated attackers can use SSL stripping or DNS spoofing to redirect you to fake banking pages. With a VPN: Significantly safer because the VPN encrypts all traffic at the device level before it reaches the WiFi network. For maximum security, also use your bank's official mobile app (harder to spoof than websites) and enable two-factor authentication on your account.

5 Things You Should Never Do on Public WiFi (And How to Stay Safe)

That free coffee shop WiFi is probably being monitored — by hackers, the shop owner, or both. Here are 5 things to avoid, how each attack works, and the one tool that neutralizes all of them.

The Threat Landscape

Public WiFi networks are inherently insecure by design. They're open — no password needed to join. No encryption protects the traffic between devices and the router. Anyone connected to the same network can run freely available tools like Wireshark to capture and inspect network traffic. They're also easy to impersonate — attackers set up rogue hotspots with names like "Starbucks_Free_WiFi" that look identical to the real thing, then intercept everything that passes through.

Evil twin attacks have increased 300% since 2023. The tools to execute them are free and the barrier to entry is near zero. Here are the five most dangerous things you can do on an unprotected public network — and exactly what happens if you do them.

Never log into your bank or financial accounts.
Even if your banking site uses HTTPS, logging in on public WiFi exposes your session to Man-in-the-Middle attacks. An attacker on the same network can intercept the connection, present a fake login page that looks identical to your bank's, and capture your credentials. They can also steal session cookies after you log in, giving them access to your account without needing your password. If you must access banking on the go, use cellular data (which is encrypted between your device and the tower) or connect to a VPN first.

Never enter passwords on unencrypted websites (HTTP).
HTTP websites transmit everything in plaintext — your username, password, and all data — visible to anyone on the network. Even on HTTPS sites, an attacker can use SSL stripping to downgrade your connection to HTTP without you noticing. The address bar still looks normal, but your data flows unencrypted. A VPN adds encryption before your data hits the network, so even stripped connections travel through an encrypted tunnel.

Never connect to WiFi without verifying the network name.
Ask an employee: "What's the exact WiFi name?" Evil twin attacks work because "Starbucks_WiFi" looks like "Starbucks WiFi" — and the fake one often has a stronger signal. Once connected, the attacker can see everything you do, redirect you to fake websites, and inject malware into your downloads. Before connecting, verify the network name. Turn on your VPN before joining any public network.

Never send sensitive files or documents unprotected.
Sending a PDF with your tax return, a contract with confidential terms, or a photo of your passport — all of these are interceptable on public WiFi. Email attachments, file transfers, and cloud uploads all travel through the network. Without a VPN, they're visible to anyone capturing traffic. With a VPN, the transfer is encrypted from your device to the VPN server.

Never leave your WiFi on and set to auto-connect.
Your phone constantly scans for known networks. Attackers exploit this by spoofing common SSIDs — "attwifi," "xfinitywifi," "Starbucks WiFi" — causing your device to automatically connect to their rogue hotspot without you even knowing. Disable auto-connect for open networks in your WiFi settings. When you're not actively using WiFi, turn it off. Better yet: enable your VPN's auto-connect-on-WiFi feature so it activates automatically on any untrusted network.

The Universal Fix

All five of these threats share a common vulnerability: unencrypted traffic on an untrusted network. And they share a common solution: encrypt your traffic before it touches the network. A VPN does exactly that. It creates an encrypted tunnel that starts on your device and ends at a secure VPN server — bypassing every threat on the local network. The attacker can capture every packet; all they'll see is encrypted noise.

More security guides: public WiFi VPN protection · what your ISP sees · unblock websites anywhere.

Make Any WiFi Safe in One Tap

Shield VPN encrypts your traffic on any network — coffee shop, airport, hotel, or rogue hotspot. WireGuard + AES-256. 30-day money-back guarantee.

Download on Google Play