Is Airport and Hotel Wi-Fi Safe? A Traveller's Security Guide

Airport and hotel Wi-Fi is safe enough for everyday browsing, maps and streaming, but it is not the place for banking or signing in to important accounts unless you are sure you are on the real network. The main risks are fake hotspots that copy a real network’s name, fake login pages, and open networks that anyone nearby can share.

You do not need to avoid public Wi-Fi altogether. Know which tasks are low risk, change a few phone settings before you leave, and switch to mobile data for the handful of things that really matter. This guide draws on the Canadian Centre for Cyber Security, Get Cyber Safe, and Apple and Google’s support pages.

Is airport Wi-Fi safe? The real risks explained

Public Wi-Fi in airports, hotels and cafés is convenient precisely because anyone can join it. That openness is also the problem. The Canadian Centre for Cyber Security’s guidance on Wi-Fi security names these places as common targets and advises against sending sensitive information over open networks without extra encryption.

Most airport networks are exactly what they claim to be. The risk is that you usually cannot tell the real network from a convincing copy, and that you share it with hundreds of strangers. Three scenarios account for most of the concern.

Evil-twin hotspots

An evil twin is a fake access point set up to look like a trusted one. It might be called “Airport_Free_WiFi” when the real one is “Airport Free WiFi”, or it might copy the name exactly. If your phone joins it, everything you do online passes through equipment controlled by whoever set it up.

Get Cyber Safe’s page on public Wi-Fi warns that criminals create fake networks with the same location or a similar name to lure users. Its advice is simple: confirm the network name with the business before you connect. In a hotel, that means the front desk or the card in your room. In an airport, look for official signage rather than picking the strongest signal in the list.

Fake captive portals

A captive portal is the login page that appears when you join hotel or airport Wi-Fi. A legitimate one typically asks you to accept terms, enter a room number or voucher code, or give an email address. A fake portal on an evil-twin network can look identical, then ask for something it should never need.

Treat any Wi-Fi login page that asks for your email password, a social media sign-in, or full card details for “free” Wi-Fi as a red flag. Close it, disconnect, and ask staff for the correct network.

Unencrypted and open networks

An open network has no password, so the radio link between your phone and the access point is not encrypted. Get Cyber Safe advises against relying on the network’s wireless encryption to protect your data in any case, and the Cyber Centre’s mobile device security guidance recommends avoiding open networks that need no password, because they are easy to intercept.

Even a password-protected hotel network is shared. If the password is printed on every room key card, every guest has it, so a password alone does not make the network private.

What HTTPS protects on public Wi-Fi, and what it doesn’t

Most websites and apps now use HTTPS, shown in browsers by a padlock or a secure-connection icon. It is the single biggest reason public Wi-Fi is less risky than it was a decade ago, and Get Cyber Safe tells travellers to stick to HTTPS sites. But it helps to know where its protection stops.

What HTTPS does: it encrypts the content of your connection to a website. Someone else on the same hotel network cannot read the password you type into your bank’s real site, the messages you read in webmail, or the card number you enter at checkout.

What HTTPS does not do:

• It does not prove a site is genuine. The Cyber Centre’s overview of web browser security notes that HTTPS is not a guarantee that a site is legitimate, and that attackers can fake the look of a secure site. A phishing page can show a padlock too.
• It does not vouch for the Wi-Fi network. A fake captive portal can use HTTPS. The padlock only tells you the connection to that page is encrypted, not who runs it.
• It does not cover everything. Older apps, some smart devices and any page served over plain HTTP send data without that protection.
• It does not hide where you go. The network operator can still generally see which services you connect to, even when it cannot see what you do there.

Tip: If your browser shows a certificate warning on public Wi-Fi, especially on a site you use every day, do not tap through it. Disconnect from the network and try again on mobile data.

Is hotel Wi-Fi safer than airport Wi-Fi?

Not in any reliable way. Both are shared networks run by a business you do not control. A per-room password beats a single shared one, and a shared password beats an open network, but none of them equals your home Wi-Fi.

The more useful question is what you are about to do. Reading the news on hotel Wi-Fi carries very little risk. Logging in to your bank from the lobby is the kind of task both Get Cyber Safe and the Cyber Centre suggest saving for a trusted connection.

Public Wi-Fi risk by activity

The table below sorts common travel tasks by how much is at stake if something goes wrong on a network you do not trust. It is a practical guide, not a measured risk score.

Activity	Risk on public Wi-Fi	Safer approach
Online banking, investment or tax accounts	High	Use mobile data, or wait for a trusted network
Shopping and entering card details	High	Use mobile data; check the web address carefully
Signing in to email or your password manager	Medium to high	Use mobile data; turn on two-step verification with an app or passkey
Work systems and files	Medium to high	Use your employer’s VPN, or mobile data
Messaging apps with end-to-end encryption	Low to medium	Fine on Wi-Fi once you are on the real network
Social media browsing (already signed in)	Low to medium	Fine; avoid fresh sign-ins on unfamiliar networks
Maps, transit apps, weather	Low	Fine on Wi-Fi
Streaming video and music	Low	Fine on Wi-Fi, and saves your mobile data
Reading news and general browsing	Low	Fine on Wi-Fi

A sensible pattern for most trips: use public Wi-Fi for the heavy, low-risk tasks such as streaming, app updates and photo backups, and keep mobile data for banking, payments and account sign-ins. Our guide to how much data you need when travelling shows that the sensitive tasks use very little data, so this split costs almost nothing.

Wi-Fi settings to change before you travel

A few minutes in Settings before you leave removes most of the accidental exposure. Menu names change slightly between software versions, so each step below links to the official page.

iPhone: turn off auto-join and forget public networks

Apple’s guide to forgetting a Wi-Fi network or stopping auto-join gives two options. Go to Settings > Wi-Fi, tap the More Info button next to a network, then either turn off Auto-Join (the phone remembers the network but will not join it on its own) or tap Forget This Network. If the network is not currently in range, tap Edit at the top of the Wi-Fi screen to see saved networks.

Apple notes that forgetting a network on one device also removes it from your other Apple devices that share iCloud Keychain, which is handy after a trip. Forgetting a network does not stop it appearing in the list; it only stops your phone joining it automatically.

iPhone: keep the private Wi-Fi address on

Every phone has a hardware Wi-Fi address that networks can use to recognise it. Apple’s page on private Wi-Fi addresses explains that an iPhone can use a different address for each network instead. On iOS 18 or later, open the network’s More Info screen and set Private Wi-Fi Address to Fixed or Rotating. Apple says Rotating, where the address changes every two weeks, is the default on networks with weak or no security.

Leave this on for airport and hotel networks. It reduces how easily networks can track your device across locations. It does not encrypt anything, so it complements the other steps rather than replacing them.

Android: stop automatic connections and use a randomised address

On a Google Pixel, the advanced network settings are under Settings > Network & internet > Internet > Network preferences. Turn off Connect to open networks so the phone does not join public networks by itself. You may also want to turn off Turn on Wi-Fi automatically, which switches Wi-Fi back on near saved networks.

For each network, tap the settings icon next to it and check that Randomized MAC address is selected. To remove a saved network, Google’s Android Help says to go to Settings > Network & internet > Internet, touch and hold the network and tap Forget. Samsung and other Android brands use similar options with slightly different menu names.

On every device

• Turn Wi-Fi off when you do not need it. Get Cyber Safe recommends this so your device does not join an unsecured network on its own.
• Install updates before you leave. Get Cyber Safe notes that outdated devices are easier to attack on shared networks.
• Keep your laptop’s firewall on. It limits who on the same network can reach your computer.

Should you use a VPN on public Wi-Fi?

A virtual private network creates an encrypted tunnel between your device and the VPN provider, so other people on the hotel network cannot read your traffic. Get Cyber Safe suggests a VPN if you use public Wi-Fi often, and notes that many internet providers offer one as an add-on.

Two caveats are worth knowing. The Cyber Centre’s mobile guidance says a VPN is not foolproof, and it points out that a third-party VPN service can see your traffic instead of the hotel network. Choose a provider you trust, and if you travel for work, use your employer’s VPN for work systems. A VPN also does nothing about fake login pages or phishing sites, so the habits above still apply.

When is mobile data the safer option?

For banking, payments and account sign-ins, mobile data is usually the safer choice. You are not sharing a local network with strangers in the departure lounge, you do not have to guess which network name is real, and there is no captive portal for anyone to imitate. Get Cyber Safe’s advice on cyber security while travelling is to prefer your own cellular service over public Wi-Fi.

The catch for Canadians has always been cost. Using your home plan abroad usually triggers a daily roaming fee, which our comparison of Bell, Rogers and Telus roaming vs an eSIM sets out in detail. A travel eSIM solves that: it is a prepaid data plan that connects to local networks at your destination, so you can keep sensitive tasks on mobile data without watching a daily meter.

With ArriGo, plans are data only and you can install the eSIM before you fly. The QR code arrives by email within about a minute, and the validity days start only when the eSIM first connects at your destination. Most plans also allow hotspot, so you can share your phone’s connection with a laptop instead of joining hotel Wi-Fi; our guide to using your phone as a hotspot for a laptop covers the setup. If you are not sure your phone supports eSIM, run it through our compatibility checker.

If you visit several countries on one trip, a multi-country plan keeps you on the same eSIM throughout:

Signs you may have joined a fake network, and what to do

Most of the time nothing goes wrong. But a few signs suggest you should stop and disconnect:

• A login page asks for something unusual, such as your email password or a social media sign-in to get free Wi-Fi.
• Your browser shows certificate warnings on sites that normally load without complaint.
• Apps suddenly ask you to sign in again right after you joined a new network.
• There are two networks with nearly identical names, and staff only recognise one of them.

If any of these happen, disconnect and forget the network, then switch to mobile data. If you entered a password on a page you now doubt, change it from a trusted connection and turn on two-step verification using an authenticator app or a passkey rather than SMS where the service allows it. Our guide to SIM swap and SMS scams while travelling explains why app-based codes are the stronger choice, and how to protect the Canadian phone number those codes are often sent to.

Your next step

Before your next trip, spend five minutes on the basics: turn off auto-join for public networks, check your private Wi-Fi address setting, install pending updates and decide which tasks you will keep on mobile data. Our pre-flight phone checklist puts these alongside the other things worth doing before you leave.

Then pick a data plan for where you are going. Browse plans for Europe, the United States, a multi-country global plan or any of our destinations, and see which local networks each plan uses on our networks page. If you have questions about installation or hotspot use, our help centre has the answers.