Public Wi-Fi: What Attackers Can Actually See

You're at a café. You connect to the free Wi-Fi. You check your email, scroll through your messages, maybe log into something. It feels completely normal.

On the same network, someone two tables away opens a laptop and starts watching.

This isn't a hypothetical. It's a well-documented attack vector, and the tools required are freely available and require minimal technical skill. Here's what an attacker on the same public network can realistically see — and what actually protects you.

When you connect to a public Wi-Fi network, you're sharing a broadcast domain with every other device on that network. In a default configuration, your device and the attacker's device are peers — neither has more inherent trust than the other.

This creates the conditions for several attack types. The most relevant for everyday users are:

• Passive sniffing — capturing unencrypted traffic as it passes through the network
• ARP spoofing / man-in-the-middle — positioning between your device and the router to intercept traffic
• Evil twin attacks — creating a fake access point that mimics a legitimate one

If you visit a website that uses plain HTTP (not HTTPS), an attacker can see the full content of your request and the server's response. That includes form data, login credentials, session tokens, and the content of pages you're viewing.

In 2026, most major websites use HTTPS. But not all do. And some older apps still transmit data over unencrypted connections.

Even when your actual web traffic is encrypted, your DNS queries — the requests your device makes to translate domain names into IP addresses — are often sent in plaintext. This means an attacker can see which websites you're visiting, even if they can't see what you're doing on them.

What protects you: DNS over HTTPS (DoH) or DNS over TLS (DoT), which encrypt your DNS queries. Most modern browsers support DoH. Enable it.

Even with HTTPS, an attacker can observe the timing, size, and destination of your encrypted traffic. This metadata can reveal a surprising amount — which services you're using, how long you're spending on them, and patterns in your behaviour.

If a website sets a session cookie without the Secure flag, that cookie can be transmitted over HTTP and intercepted. An attacker who captures your session cookie can impersonate you on that service without needing your password.

This is less common than it was a decade ago, but it still happens with poorly configured sites and older apps.

When you're using HTTPS correctly:

• The content of your communications is encrypted and unreadable
• Your passwords are not transmitted in plaintext
• The body of your emails, messages, and form submissions is protected

End-to-end encrypted messaging apps (Signal, WhatsApp with E2E enabled) add another layer — even if traffic is intercepted, the content is encrypted at the application layer and cannot be read without the private keys on your device.

The most underestimated attack on public Wi-Fi isn't passive sniffing — it's the evil twin. An attacker creates a Wi-Fi network with the same name as the legitimate one (e.g., "CafeGuest"). Your device, which has connected to "CafeGuest" before, may automatically connect to the attacker's network instead.

Once you're connected to the attacker's network, they control the DNS, can intercept unencrypted traffic, and can serve you modified versions of websites — including fake login pages.

What protects you: Forgetting public networks after use, disabling auto-connect, and using a VPN.

1. Use a VPN. A reputable VPN encrypts all traffic between your device and the VPN server, making passive sniffing and most MITM attacks ineffective. This is the single most impactful protection for public Wi-Fi use.

2. Check for HTTPS. Before entering any credentials or sensitive information, confirm the site is using HTTPS. Look for the padlock icon and verify the domain is correct.

3. Enable DNS over HTTPS. In your browser settings, enable DoH to prevent DNS-based surveillance.

4. Disable auto-connect. Don't let your device automatically connect to known networks. Manually connect each time.

5. Use your mobile data for sensitive tasks. For banking, accessing sensitive accounts, or anything that matters, use your mobile data connection instead of public Wi-Fi.

Signs that something may have gone wrong include: unexpected logouts from accounts, login alerts from unfamiliar locations, or noticing that a website looked slightly different than usual (a potential sign of a MITM attack serving a modified page).

If you suspect your credentials or session tokens were intercepted, change your passwords immediately from a trusted network, enable two-factor authentication on all accounts, and review recent account activity for unauthorised access. If you notice unexpected logouts from accounts or login alerts from unfamiliar locations, follow the incident response steps immediately.

If the situation involves sensitive accounts or you believe you're being targeted specifically, a professional device forensic review can establish what was accessed and when.