This question already has an answer here:
I'm getting into network security and similar lately (still a noob though) and I was playing around with wireshark. I know you can sniff http traffic very easily and I read here on stack exchange that it is somehow possible to sniff https (I didn't completely understand how it worked) with a tool called charles proxy (www.charlesproxy.com/). So my question is, is it really safe to e.g. log into your amazon or bank account (which is https secured) on a public wifi you trust? Given you are connected to a wifi hotspot you trust like a hotel wifi, where you know they won't be sniffing your banking credentials, can a user connected to the same wifi sniff your https encrypted password? And could a vpn service like tunnel bear prevent someone from getting your information as the vpn encrypts your data?