Yes, a little, but far less than it was ten years ago. The FTC now says that connecting through public Wi-Fi is usually safe, because nearly every site and app encrypts data. Someone at the next table can't simply read your email or bank balance off the air anymore.
Google is closing the remaining gap too. Chrome 154, due this month (October 2026), turns on "Always Use Secure Connections" for everyone, so the browser asks before loading any public site over plain HTTP.
The risk that's left is real, though, and it mostly comes from the network itself being hostile rather than someone eavesdropping on it:
- Fake hotspots. A rogue network with a believable name can serve a phishing login page or try to intercept your traffic.
- Hijacked captive portals. The sign-in page is the weak spot, since it runs before any protection kicks in and is a natural place for fake prompts.
- Metadata. Even with HTTPS, the network can usually see which domains you visit and when.
- Your own device settings. File sharing, AirDrop open to everyone, or an unpatched laptop give other people on the network something to poke at.
How risky it is for you depends on what you do. Checking a map or the news on café Wi-Fi is low stakes. Logging into work accounts on a hotel network you didn't verify carries more. The FTC guidance that calls public Wi-Fi mostly safe still assumes you watch for fake sites, keep software updated and use two-factor authentication, which is where most of the remaining protection comes from.