Can someone read my passwords on public Wi-Fi?

Not on a site whose connection is encrypted, which is the norm today: the intermediary sees the destination, not what's exchanged. The image of passwords read in the clear corresponds to unencrypted connections, which have become rare on the web. The real points of attention lie elsewhere: a network login page that gets you to type a credential, a certificate you're pushed to install, an old app that transmits without encryption.

So what exactly does the observer see?

Which services you contact, when, and how much data goes through. That's already personal information — the list of sites you visit can be sensitive in itself — but it isn't the content of your exchanges.

Do I need a VPN on a public network?

It's useful if you want the local network not to see your destinations. Just know what you're doing, though: you're transferring that visibility to the VPN provider. The question isn't whether to use one, but who you'd rather grant that trust to.

Network Traffic Interception

In plain terms

Listening in on what passes over a network, without changing anything. What can be gained from it depends entirely on encryption — much less than people imagine, and more than one would like.

Definition

Traffic interception is the passive observation of data traveling over a network by a third party able to see it pass by. It changes nothing and leaves no trace for the person being observed, which makes it undetectable from their side — this entry therefore mainly explains what it actually allows, and what encryption protects.

How it works

To observe, you have to be on the path: providing the network, being present on the local network, or administering a piece of equipment the traffic crosses. What the observation yields then depends on encryption, and that distinction is the key thing to remember. With an end-to-end encrypted connection — the case for nearly all sites today — the observer sees which services you connect to, at what times and in what volumes, but not the content exchanged: not the password typed, not the page viewed, not the message sent. That's not nothing: the list of services you use is itself information, sometimes sensitive. Without encryption, it sees everything, and the old image of passwords read in the clear on a public network corresponds to that situation, now marginal on the web. The risk has therefore shifted rather than disappeared: today it bears on metadata, on old or poorly designed apps that don't use an encrypted connection, and on maneuvers aimed at bringing that encryption down — installing a certificate, a login page demanding you type something in.

Warning signs

No sign at all: passive observation is undetectable from the observed device
App displaying an unsecured-connection warning
Network requiring you to install a profile or certificate before granting access
Site normally on a secure connection displaying without one, on this network only

How to verify

There is nothing to check on the observation side, and claiming otherwise would be misleading. What can be checked is your own exposure: are your connections encrypted, have you installed a certificate requested by a network, does an old app still transmit in the clear. That's where the difference between seeing your destinations and seeing your data plays out.

What to do

Use services and apps that encrypt their connections, and keep them up to date. Don't install any certificate or network profile requested to 'access the internet.' On a network you don't control, a VPN hides your destinations from the local observer — while revealing them to its own provider, which is a trade-off to make knowingly, not an automatic fix.

If it already happened

Remove any certificate or profile installed at a network's request. From a trusted connection, change the passwords of services used during the period concerned, starting with those you know weren't running over an encrypted app. Close open sessions. Report the incident to the relevant authority.

Frequently asked questions

Can someone read my passwords on public Wi-Fi?: Not on a site whose connection is encrypted, which is the norm today: the intermediary sees the destination, not what's exchanged. The image of passwords read in the clear corresponds to unencrypted connections, which have become rare on the web. The real points of attention lie elsewhere: a network login page that gets you to type a credential, a certificate you're pushed to install, an old app that transmits without encryption.
So what exactly does the observer see?: Which services you contact, when, and how much data goes through. That's already personal information — the list of sites you visit can be sensitive in itself — but it isn't the content of your exchanges.
Do I need a VPN on a public network?: It's useful if you want the local network not to see your destinations. Just know what you're doing, though: you're transferring that visibility to the VPN provider. The question isn't whether to use one, but who you'd rather grant that trust to.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

Also known as: sniffing, network eavesdropping, traffic capture, network spying.

This article is part of the Network and Wi-Fi attacks family. Last updated: 2026-09-03.