How to use airport Wi-Fi safely

Airport Wi-Fi is fine for most of what you do at a gate. Almost every site you use is encrypted now, and that changes the old advice. What still matters is picking the right network, giving the sign-in page nothing extra, and turning a few phone settings off. For the bigger picture, start with Is free public Wi-Fi safe?

Find the real network name

Big airports publish the exact name of their free network. Look it up before you tap anything. Here is what five of the busiest US airports say on their own sites.

Notice the underscores. LAX, JFK, and O’Hare start the name with one so it sorts to the top of your list. A lookalike network often skips that detail. If the name you see does not match the airport’s site, or there are two close variants, CISA’s travel tip card says to confirm the network name and the exact login steps with staff before you connect (CISA).

Why fake hotspots still matter

CISA describes the “evil twin” attack this way: someone copies a legitimate public access point and broadcasts a stronger signal, so your device picks the copy (CISA). Once you are on their network, they are the network operator.

That matters less than it did in 2012, but it is not nothing. Even when a site is encrypted, whoever runs the network can see the domains, IP addresses, and ports your device talks to, and NIST notes they can use that to set up an adversary-in-the-middle attempt (NIST NCCoE). For the warning signs, see How to tell if a Wi-Fi hotspot is fake.

What the sign-in page can and cannot see

The page that pops up after you join is a captive portal. Apple’s description: after you tap the network, wait for a login screen, where you may need to enter a username and password, give an email address, or accept terms (Apple).

Three rules for that page:

1. Give it only what the airport says it asks for. ATL asks for a form and terms. DFW asks for terms. LAX and O’Hare show an ad. None needs a password to an account you already have.
2. O’Hare’s tip to open a non-https address is normal. The portal has to intercept an unencrypted request to show itself. Use a throwaway address, not your email or bank.
3. The portal operator is also the network operator. EFF puts it this way: HTTPS stops eavesdroppers from reading your content, but they can still see where you are connecting from and which sites you connect to (EFF). The airport’s Wi-Fi provider can log that you visited your bank’s domain. It cannot read what you did there.

What HTTPS protects, and what it does not

The FTC’s current guidance is direct: because most websites now use encryption, connecting through a public Wi-Fi network is usually safe. Look for the lock symbol or “https” in the address bar, including on your phone (FTC).

Two gaps remain:

• HTTPS does not hide which sites you use. EFF is clear that HTTPS is not an anonymity tool (EFF).
• HTTPS does not vouch for the site. The FTC warns that scammers build fake sites and encrypt them so they look safe. Encryption protects data on the way to the site, not from the people running it (FTC).

Apps are harder to check. The FTC says it can be hard to tell whether a mobile app encrypts, but most do (FTC).

Turn off auto-join and nearby sharing

Do this before you walk into the terminal. It takes two minutes.

iPhone

• Auto-Join. Settings, then Wi-Fi, then Edit to see known networks. Tap the info button next to a network and turn off Auto-Join. The phone remembers the password but will not rejoin on its own (Apple).
• Auto-Login on captive networks. Turn it off if you want to see the sign-in screen each time instead of being logged in silently (Apple).
• AirDrop. Open Control Center, touch and hold the connectivity controls, tap AirDrop. Pick Contacts Only or Receiving Off. “Everyone for 10 Minutes” switches back to Contacts Only after 10 minutes on iOS 16.2 or later (Apple).
• Private Wi-Fi Address. Leave it on. Your iPhone identifies itself to each network with a different address, so a fixed hardware address cannot track you across networks (Apple).

Android

• Connect to open networks. On Pixel: Settings, Network & internet, Internet, Network preferences. Turn off “Connect to open networks,” which otherwise auto-joins high-quality open networks (Google). Menus vary by maker.
• Quick Share. Open Settings, search “Quick Share,” tap “Who can share with you,” and choose “Your devices” or “Contacts.” “Everyone for 10 minutes” reverts on its own (Google).
• Randomized MAC. Android 10 and later use a randomized address by default, and you can turn it on or off per network in Network details (Android Open Source Project). Leave it on.

CISA’s tip card adds Bluetooth to the list: turn it off when you are not using it so you only pair when you mean to (CISA).

When a VPN is worth it

A VPN closes the gap HTTPS leaves. Proton VPN’s own documentation says it encrypts the connection between your device and the VPN server, so the host of a public Wi-Fi network cannot see your activity. It also says what it does not do: a VPN on its own does not protect you from malware, and it cannot stop cookie or fingerprint tracking by websites (Proton VPN).

Pick one carefully. The FTC’s advice before installing any VPN app: make sure it encrypts your information, review its permission requests, and check whether it shares your information with third parties (FTC). Our comparison is at Best VPN for public Wi-Fi. If you just want one name, Proton VPN is the vendor whose docs are cited above.

One practical note. Sign in to the airport’s portal first, then turn the VPN on. The portal needs to see an unencrypted request to show you the page.

Use mobile data for the logins that matter

The FTC says public Wi-Fi is usually safe because of HTTPS. CISA still says that if you must bank or shop while traveling, turn off Wi-Fi and use your cellular data connection instead, because a mobile network connection is generally more secure than a public wireless one (CISA, CISA tip card).

Both are right. Banking over HTTPS on airport Wi-Fi will almost always be fine. Doing it on mobile data removes the network from the picture entirely, and a bank login uses almost no data. We go deeper in Is online banking safe on public Wi-Fi? If data is tight, see free and cheap mobile plans.

Pre-flight checklist

1. Look up the airport’s official network name on its website. Write it down.
2. Update your phone. CISA’s first travel tip is to update the operating system and apps before you go (CISA).
3. Turn off Auto-Join (iPhone) or “Connect to open networks” (Android).
4. Set AirDrop to Contacts Only and Quick Share to Contacts or Your devices.
5. Turn Bluetooth off if you are not using headphones.
6. At the gate, pick the exact name from the table. Ignore near matches.
7. On the sign-in page, give only what the airport says it asks for. Use a throwaway address if you need to trigger the page.
8. Check for the lock icon before you type a password anywhere.
9. Turn on your VPN after the portal lets you through.
10. Bank, pay, or change passwords on mobile data, not Wi-Fi.
11. When you board, forget the network so the phone does not rejoin on your way back (Apple).