Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it safe to log into my bank website over a public wifi (like a coffee shop)?

I apologize if this is a really dumb question. I realize that the connection between the browser and bank servers should be encrypted, however I'm wondering if there are any other "gotchas".

Thanks so much!

share|improve this question
threats over public wifi here… – BlueBerry - Vignesh4303 Apr 25 '13 at 13:54
It's not safe to even have a web enabled bank account. If your account has more than $50,000 in it, it is only a question of time before it gets hacked, regardless of whether you use public Wifi or not. If you have less than $10,000 in the account, noone will bother hacking it. – Tyler Durden Jun 11 '14 at 0:50

If your bank Web site uses HTTPS, and you dutifully check that the server name in the URL is indeed the expected name, and you don't disregard warnings about unverified or expired certificates, then yes, it is safe.

If these conditions are not met, then no, it is not safe -- but it would not be safe from anywhere else either. Public WiFi is not special in that matter.

What may make public WiFi especially unsafe is that public WiFi occurs in public areas. Public areas are full of strangers. When you enter your bank password, you don't want weird people to spy on your keyboard or tablet screen. That kind of physical security is quite harder to achieve in a park or a restaurant, than in the privacy of your home.

share|improve this answer
Public WiFi is also often unencrypted which allows other connected devices to read packets in transit. I would consider this a significantly higher risk than using a wired connection at home. (Still a risk, but I would argue a much smaller risk.) – Nathan Osman Jul 6 '15 at 20:05
This will be obvious to many, but If you type "" instead of "";, you are vulnerable. – Kevin Wheeler Dec 12 '15 at 15:53
Heh, looks like the formatter ate the https:// there – Juan Carlos Coto Apr 14 at 4:56

Connecting to your bank over any WiFi that you do not absolutely trust is a mistake (in case you have a lot of money, of course). While in theory checking the URL and warnings does provide a level of assurance that you're not being MITM-ed (traffic is not intercepted), there are tools that work most of the time by utilising, for example, homonymic domain names.


There are also tools that will fake any BSSID (wifi station ID) that your wireless device is looking for, and then do their interception.


P.S. In theory, theory and practice are the same. In practice, they are different.

share|improve this answer
Can someone explain why this answer doesn't have any upvotes? It seems like a good answer? – Kevin Wheeler Sep 9 '15 at 20:22
@KevinWheeler I think my answer wasn't along the "scare everyone" tactic that many in the security profession prefer. Most of "advice" repeated by newbies is, unfortunately, crap. – Vitaly Osipov Sep 11 '15 at 17:19
From what I understand, sslstrip will redirect a user to either an unencrypted page, or a spoofed encrypted page; and sometimes use a favicon to make it LOOK like the "lock icon" is there. If a user is careful to check the URL, and checks that the icon is in the correct place, doesn't HTTPS still provide protection? Especially the extended validation certificate used by many banks? – Ben Jun 13 at 13:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.