The Borrowed Connection: A Calm Guide to UK Café and Pub Wi-Fi

There is a particular British ritual to it. You order a flat white, a half of something, or a hotel breakfast, then ask the person behind the bar for the Wi-Fi password. They point at a laminated card. You tap Join. A login page appears. And somewhere between the first sip and the first email, a small voice asks: is this actually a good idea?

The honest answer is: usually, yes, with a few sensible habits. Public Wi-Fi is not automatically a den of thieves, and it is not automatically safe either. It is a borrowed connection. Treat it like borrowing a friend's kitchen: fine for making toast, less ideal for conducting your entire financial life.

What a public network can actually see

A Wi-Fi operator can see that your device connected, roughly when, and which websites or services you reached. On unencrypted pages, they may be able to see more. On encrypted pages, the contents should be scrambled. Most modern websites use HTTPS, which is the padlock-and-https bit in your browser, so the network should not see your password or your card details in plain text.

That is the reassuring part. The less reassuring part is that the network can still influence what you see. It can show you a login page. It can block certain sites. It can pretend to be a different network. And in a busy pub or hotel, you cannot always tell who is running the hotspot you just joined.

This is why the useful question is not 'is public Wi-Fi dangerous?' It is 'what am I about to do on it?' Checking the football scores is a different risk from moving money between accounts.

The login page is the tell

Most legitimate venues use a captive portal: a page that asks you to accept terms, enter a room number, or maybe give an email address. That is normal enough. What deserves a second look is a login page that asks for something a pub would not need.

If a café Wi-Fi page asks for your bank details, your main email password, or your social media login just to get online, close the tab and ask staff. If it asks you to install a profile, accept a certificate, or download a 'Wi-Fi helper' app, be very wary. Those are not standard steps for joining a normal hotspot.

Also check the network name. 'FREE_WIFI_GUEST' and 'Free_WiFi_Guest_5G' may look similar, but only one may belong to the venue. Ask the person behind the bar which name is theirs. Turn off auto-join for open networks so your phone does not quietly latch onto something with a friendly name and unclear ownership.

A two-minute checklist before you tap Join

You do not need a security briefing every time you want to check train times. A short routine is enough.

• Confirm the network name with staff, especially if more than one looks plausible.
• Turn off auto-join for open Wi-Fi, and forget old networks you no longer use.
• Look for HTTPS and the padlock before entering anything sensitive. If your browser warns you about a certificate, stop.
• Use mobile data for banking, government services, and anything involving a password reset or payment.
• Save the heavy admin for home if you can. A pub table is not the place to reorganise your pensions.
• Keep your phone, laptop, and browser updated. Many public Wi-Fi risks are ordinary software bugs with ordinary fixes.
• If you are on a laptop, check that file sharing and AirDrop-style sharing are off in public.

None of this is about being frightened of the internet. It is about matching your caution to the setting. You would not count a wad of cash on a busy train platform. The same instinct applies to your inbox.

Banking apps, padlocks and the limits of HTTPS

The padlock is useful, but it is not a character reference. It means the connection between you and the website is encrypted. It does not prove the website is honest, or that the Wi-Fi network is run by the venue. A fake login page can still look polished.

Banking apps generally add their own layers: encryption, app checks, and sometimes device verification. That is good. But if you are on an unfamiliar network and something feels off, use 4G or 5G instead. Most UK mobile plans have enough data for a quick balance check, and your bank will not think less of you for waiting until you are on a trusted connection.

Avoid entering card details into a captive portal. A hotel Wi-Fi page should not need your card number to let you read the news. If it does, question it.

When a VPN earns its keep

A VPN creates an encrypted tunnel between your device and the VPN provider, so the local Wi-Fi operator sees less of your traffic. That can be useful on hotel and café networks, particularly if you are handling work email or logging into accounts you would rather not expose to a shared connection.

But a VPN is not a cloak of invisibility. It shifts trust from the Wi-Fi operator to the VPN company. Free VPNs have to make money somehow, and 'free' is not always a bargain. If you use one, choose a reputable provider, and follow your employer's rules if you are on a work laptop.

For a quick scroll through the news with a cup of tea, a VPN is usually overkill. For a work session on a hotel network, it is a reasonable seatbelt.

After the last sip: forget, tidy, move on

When you leave, tell your device to forget the network. It takes seconds and stops your phone from reconnecting automatically next time you are nearby. If the venue gave you a portal account, log out where possible. Close the tabs you no longer need.

Then get on with your day. The pub Wi-Fi pact is simple: the venue lends you a connection, and you bring a bit of common sense. Use mobile data for the crown jewels, check the login page before you trust it, and do not let a laminated password card talk you out of your own judgement.

That is not paranoia. It is just good manners towards your future self.