Browsing public information without signing in is the safest thing you can do: reading news, checking a map, looking up opening hours or a train timetable. If nothing private leaves your device, a hostile network has nothing worth stealing.
Here's roughly how common activities rank, from lowest to highest risk:
- Lowest: reading websites over HTTPS, streaming video, downloading offline maps, checking flight status without logging in.
- Low: using apps you already installed and are signed into, like WhatsApp, Spotify or your airline app. They reuse saved sessions over encrypted connections instead of asking for your password again.
- Moderate: logging into accounts for the first time on that network. The risk is less about interception and more about whether the login page is real.
- Higher: online banking, entering card details, and work accounts, especially if you reached the page through a link the Wi-Fi portal showed you.
- Highest: installing anything the network prompts for, or accepting a certificate or profile to "get online."
The NSA advises avoiding banking, shopping, medical records and sensitive conversations on public Wi-Fi altogether. That's on the cautious end; the FCC's practical suggestion is to switch to cellular data when you send private information, or use a VPN if you rely on hotspots often.
The detail that matters most is the gap between "already signed in" and "signing in now." An app using a saved session over HTTPS is hard to attack on the network. A fresh password typed into a page you reached through a hotspot is the moment attackers wait for.