Password-Protected Public Wi-Fi: What the Password Really Covers

Additional resource for the lesson “Security on Protected Public Wi-Fi Networks” — Online Privacy course

A Wi-Fi password on a café blackboard or a hotel key card feels reassuring. Password-protected public Wi-Fi does keep people outside off the network, but every other guest has the same key. This resource explains what that password does and does not cover, what the venue records about you, and how to stop your phone rejoining places on its own.

A. Why this matters

A password on a public network is like the key to a shared office kitchen. It keeps strangers out, but all your colleagues have the same key, and whoever manages the kitchen sees who comes in and when. Your privacy on that network depends on three other things: whether the sites and apps you use encrypt what you send, what the venue records, and what your phone does by itself after you leave.

None of this means avoiding hotel or café Wi-Fi. It means knowing which questions the password answers.

What the sources say

Get Cyber Safe, the awareness campaign of the Communications Security Establishment Canada, is direct about the password’s limits: “Never trust the wireless encryption on a public Wi-Fi network.” It advises relying instead on sites that use HTTPS, and confirming the network’s name with the organisation that runs it.

The Wi-Fi Alliance, the industry body that certifies Wi-Fi products, describes how the standards have moved on. Its WPA3 announcement from 2018 explains that the newer standard was designed to resist password guessing even “when users choose passwords that fall short of typical complexity recommendations”, while older WPA2 devices keep working alongside it.

The UK’s Information Commissioner’s Office (ICO), the independent data protection authority, sets the rules for the box you tick on a sign-in page. In its guidance for organisations on consent, it says that “pre-ticked boxes or inactivity should not therefore constitute consent”, and that consent “should not be bundled up as a condition of service unless it is necessary for that service”.

Apple and Google, in their help pages, describe the other half: a phone rejoins known networks automatically unless you tell it to forget them or to stop.

B. Key concepts

Five ideas for reading a network that asks for a password.

The shared key

On password-protected public Wi-Fi where one password is given to every guest, the password keeps out people who do not have it, such as someone in the car park. It does not turn the other guests into outsiders: once they have joined, they are on the same network as you, holding the same key.

Why it matters to you: The password tells you who is in the room, not who can see what. What keeps your browsing private from the other guests is mainly the encryption of the sites and apps you use.

WPA2 and WPA3 in plain words

WPA2 and WPA3 are security standards for the connection between your device and a Wi-Fi network. WPA2 has been in use for well over a decade; WPA3 is the newer one. The Wi-Fi Alliance says WPA3-Personal gives “stronger protections for users against password guessing attempts by third parties”, and that it keeps working with WPA2 devices “through a transitional mode of operation”.

For networks without a password, the Alliance’s Wi-Fi Enhanced Open is designed to give each user “unique individual encryption”, without a password or extra steps. Its security page now states that “WPA3 is mandatory for Wi-Fi CERTIFIED devices”.

Why it matters to you: These standards protect the link between your phone and the venue’s equipment, not what the venue sees about your visit. Knowing the names helps you read your phone’s network details.

What the venue can see

The organisation that runs the network is one of the parties along your route. With encrypted sites it can usually see which sites you reach and when, though not the pages or what you type; the HTTPS resource in this section explains why.

Why it matters to you: The venue is not an attacker. It is an organisation collecting personal data, and the more useful question is what it keeps, not what it could intercept.

The sign-in page and the terms

Many hotels and cafés show a sign-in page (a “captive portal”) before you can browse. It may ask for a room number, a surname, an email address or a phone number, and offer a box for “news and offers”. The terms of use and privacy notice linked from that page say what the venue, or the Wi-Fi company it uses, records and for how long.

Why it matters to you: This is where you hand over most of what the venue knows about you. Under the ICO’s consent guidance, a marketing box should not come pre-ticked, and agreeing to marketing should not be the price of getting online.

Saved networks and auto-join

Your phone remembers the networks you have joined. As Android’s help page puts it, “your device automatically connects to nearby Wi-Fi networks you’ve connected to before”. Apple describes two ways to change this on iPhone: forget the network and its password, or “just turn off Auto-Join for that network”, which keeps the password but lets you choose when to connect.

Why it matters to you: Each saved network is a standing invitation to reconnect, and each reconnection may tell that venue again that you are nearby. The list itself is also a record of the places you have been.

C. A practical example: Elena’s two days at a client’s conference

Elena is 35 and works in marketing, handling client data every day: contact lists, campaign results, unpublished drafts. This week she is at a two-day conference in a hotel, and the Wi-Fi password is printed on her room card.

• Morning: she joins the hotel network. A sign-in page asks for her room number, surname and email, with a box for “news and offers” already ticked. She taps Continue without reading.
• Mid-morning: she realises that two hundred other delegates have the same password, and wonders what “protected” actually means.
• Lunch: she opens a client’s report, stored in her company’s cloud service, which uses HTTPS.
• Afternoon: her phone, in her bag, joins the Wi-Fi of a café chain she visited months ago in another city.
• Evening: back in her room, she counts the saved networks on her phone: forty-three, most of which she cannot place.

Nothing bad happened. But she had left a clearer record of where she had been than she realised, and the “protected” label had made her think less about it, not more.

What changed when Elena looked closer

On the second evening Elena did the check in section D. A few things surprised her:

• The password had never been what protected her client’s report. HTTPS was doing that, on any network.
• The hotel’s terms said its Wi-Fi provider kept connection records for a period, and her email had gone onto a marketing list because of a box she never chose to tick.
• Her phone treated a café she had visited once as a place to rejoin automatically, every time she walked past a branch.

She made three decisions: she unsubscribed from the hotel’s marketing emails; she forgot thirty-five old networks and turned off auto-join for the few she uses rarely; and for sensitive client work on the road, she would use her phone’s own hotspot. She kept using the hotel Wi-Fi for everything else, more relaxed now that she knew what it did and did not show.

D. Try it yourself: a protected Wi-Fi privacy check (10 minutes)

Four short steps, best done the next time you join a network in a hotel, café or station, or now, with your phone in hand. Whatever your list looks like, this is a tidy-up, not a test.

Step 1 — Read the network before you join (2 minutes)

• Ask staff for the exact network name rather than guessing.
• Open the network’s details on your phone. If your phone shows its security type, note it: WPA3, WPA2, or none.

Step 2 — Read the sign-in page and the terms (3 minutes)

• Note what the page asks for: room number, name, email, phone number, or a social media sign-in.
• Open the terms or privacy notice, if there is one, and look for what is recorded, how long it is kept, and whether it is used for marketing.
• Untick any marketing box you did not choose, and give only what is needed to get online.

Step 3 — Read your saved networks as a map (2 minutes)

• On iPhone, Apple’s path is Settings › Wi-Fi, then Edit, to see the networks your device knows. On Android, Google’s help page describes Settings › Network and Internet › Internet, where saved networks are listed.
• Count them, and mark the ones you will not use again: old hotels, airports, events.
• Mark the ones you use only rarely, such as a relative’s flat.

Step 4 — Forget, or stop auto-join (3 minutes)

• For networks you will not use again, forget them. On iPhone, tap the More Info button next to the network, then Forget This Network. On Android, touch and hold a saved network and tap Forget.
• For networks you use rarely, on iPhone turn off Auto-Join in the same More Info screen: the password stays saved, but your phone joins only when you choose. On Android, the option, where it exists, is usually in the network’s details; names vary between manufacturers.

One network forgotten today is one less place your phone reconnects to without asking you.

Already covered in the Online Security course

Wi-Fi Security: When a Connection Is Safe Enough
It covers the security side of the same networks, such as lookalike “evil twin” hotspots and fake sign-in pages, while this resource looks at what a network and its operator learn about you.

E. Videos, articles and further resources

Institutional sources first, then the Wi-Fi standards body and platform help. All in English.

Institutional sources

Get Cyber Safe (Communications Security Establishment Canada) — Public Wi-Fi
Plain advice on public networks from Canada’s cyber security agency.
https://www.getcybersafe.gc.ca/en/secure-your-connections/public-wi-fi

Information Commissioner’s Office (UK) — What is valid consent?
Guidance for organisations: why pre-ticked boxes are not consent, and why consent should not be a condition of a service.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/

Wi-Fi standards

Wi-Fi Alliance — Wi-Fi Alliance introduces Wi-Fi CERTIFIED WPA3 security
What WPA3 adds over WPA2, in the standards body’s words (2018).
https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security

Wi-Fi Alliance — Wi-Fi CERTIFIED Enhanced Open delivers data protection in open Wi-Fi networks
How networks without a password can still encrypt each user’s connection (2018).
https://www.wi-fi.org/news-events/newsroom/wi-fi-certified-enhanced-open-delivers-data-protection-in-open-wi-fi-networks

Wi-Fi Alliance — Security
A current overview of WPA3, WPA3-Personal and Enhanced Open.
https://www.wi-fi.org/discover-wi-fi/security

Platform documentation

Apple Support — Forget a Wi-Fi network or prevent your device from automatically joining it
How to forget a network or turn off Auto-Join on iPhone, iPad and Mac.
https://support.apple.com/en-gb/102480

Android Help — Connect to Wi-Fi networks on your Android device
How saved networks reconnect automatically, and where to forget one.
https://support.google.com/android/answer/9075847?hl=en-GB

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: understanding what a familiar reassurance, the password on the wall, actually covers.

Skills

• Reading a network’s sign-in page and terms for what is recorded and why.
• Telling WPA2 and WPA3 apart in your phone’s network details.
• Forgetting saved networks and turning off auto-join.

Awareness

• Recognising that a shared password keeps outsiders off, not the other guests.
• Understanding that the venue is also an organisation collecting personal data.
• Knowing that a phone rejoins known networks on its own unless you tell it otherwise.

Secure Behaviour

• Giving a sign-in page only what it needs to get you online, and unticking boxes you did not choose.
• Letting your phone join rarely used networks only when you decide.
• Pruning saved networks after a trip, as a habit rather than a project.

G. Questions to sit with

• When you see a password on a café wall, what do you assume it protects, and does that assumption still hold?
• Which piece of information would you rather not give a venue just to get online?
• If someone read the list of saved networks on your phone, what would it tell them about the last year of your life?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. What you do on a shared network

• R10 — Keep sensitive data off public Wi-Fi: a password does not make a public network private, so decide in advance which tasks wait for a network you trust.
• R15 — Use WPA3 on your mobile hotspot: if you share your phone’s own connection instead, protect it with the strongest encryption your phone offers.

Minimum commitment: write down one task you will not do on any shared network, and the alternative you will use instead.

2. What your phone does after you leave

Forgetting a network removes it and its password; turning off auto-join keeps it, but waits for you.

Minimum commitment: today, forget five saved networks you will not use again.

In short

• Password-protected public Wi-Fi keeps outsiders off the network, but every guest shares the same key.
• WPA3 is the newer standard and resists password guessing better than WPA2; neither changes what the venue records about you.
• The sign-in page and its terms are where the venue learns most: give only what is needed, and untick what you did not choose.
• Forgetting old networks and turning off auto-join stop your phone rejoining places on its own.

Related resources in this course

• Public Wi-Fi Privacy: What an Open Network Learns About You
• What Does a VPN Hide? Privacy, Trust and Choosing a Provider
• What Is HTTPS? What the Padlock Tells You, and What It Doesn’t
• What Can My Internet Provider See? Home Connection Privacy

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.