Is Public Wi-Fi Safe for Downloading Apps and APK Files?
Image: Shixart1985, CC BY 2.0, via Wikimedia Commons
Public Wi-Fi in cafes, airports and hotels is convenient, but it is a network you do not control. Downloading an app or an APK file over it is not automatically unsafe, yet a few risks are worth understanding, because a tampered download is exactly what an attacker wants. This guide explains what public Wi-Fi can and cannot do, and how to download safely when you have no better option.
What the real risks are
- Fake hotspots. An attacker can create a network with a believable name, such as the cafe name followed by guest. Anything you do on it passes through their equipment.
- Unencrypted connections. Most sites now use HTTPS, which protects the content of what you send and receive. A plain HTTP download link can be altered on the way, including APK files.
- Login portals. Hotels and airports often show a sign-in page. Fake portals are used to collect passwords and email addresses.
- Other devices on the network. Some networks let devices see one another, which exposes shared folders and weak services.
What HTTPS does and does not protect
HTTPS encrypts the connection between your phone and a website, so someone on the same Wi-Fi cannot read your messages or quietly change the file you download. Look for the padlock and an address that begins with https. HTTPS does not tell you that the site itself is trustworthy, so you still need to check the source, as described in our APK safety checklist.
How apps from Google Play differ
Installing from Google Play over any network is considerably safer, because Play delivers the app over an encrypted connection and Android checks the app signature when it installs. An APK you download from a website relies on that website using HTTPS and on you checking the file yourself.
A safer routine for downloads on public Wi-Fi
- Confirm the network name with staff, and avoid networks with no password if you can.
- Do not enter passwords or card details on a login portal that asks for more than a name or room number.
- For an APK, use only an https link, then compare the file size and, if the developer publishes one, the SHA-256 hash.
- Prefer your own mobile data for anything sensitive, such as banking, and for large files you cannot afford to have tampered with.
- Turn off automatic connection to open networks, and use Forget network afterwards.
- Keep Play Protect and your phone updated. See our Play Protect guide.
Task by task
| Task | Risk on public Wi-Fi | Safer approach |
|---|---|---|
| Update apps from Google Play | Low | Fine on a known network |
| Download an APK from a website | Medium to high | Use https, check the hash, or wait for a trusted connection |
| Sign in to email or banking | Medium | Use mobile data or a VPN you trust |
| Streaming video | Low | No special steps needed |
Should you use a VPN?
A reputable VPN encrypts your traffic between your phone and the VPN provider, which helps on untrusted networks. It does not make a malicious file safe, and a free VPN that you cannot vet can be a risk of its own, because your traffic passes through it. Choose a provider with a clear privacy policy, or use mobile data instead.
Frequently asked questions
Is hotel Wi-Fi safe?
It is usually fine for ordinary browsing but is still a shared network. Apply the same precautions as for any public Wi-Fi.
Does a padlock mean a download is safe?
No. It means the connection is encrypted. The file can still be malicious if the site is not trustworthy.
Should I download large games on public Wi-Fi?
From Google Play it is fine, apart from the data limits some networks impose. For an APK from another site, wait for a network you trust. See also how to free up storage before you start.