Here’s something nobody explains when you tap ‘connect’ at the coffee shop or the hotel lobby: the person running that Wi-Fi network can see a lot more than just the fact that you’re online.
Every device that connects to a Wi-Fi network is identified automatically. That identification includes your device’s hostname (basically its name, like ‘Jessica’s iPhone’), its IP address, and its MAC address — which is a unique hardware ID that’s baked into your device’s network chip at the factory. A router admin can pull up a connected devices list through the router’s admin panel and see exactly which devices are on the network. That’s not a hack. It’s just how Wi-Fi works.
And it doesn’t stop there. If a website uses plain HTTP instead of HTTPS, the router can see the actual content of what you’re looking at — not just that you visited a site, but what was on the page. HTTPS encrypts the content, so with secure sites the router owner typically only sees the domain name (like ‘reddit.com’), not the specific page or anything you typed. But plenty of sites, especially older or smaller ones, still don’t use HTTPS.
Even with HTTPS, a Wi-Fi owner can still see which sites you’re connecting to — just not what you’re doing there. They can also see how much data you’re using, which can hint at what you’re doing even without seeing the content directly.
So what can you actually do about it?
First, check that the sites you’re on use HTTPS — look for the padlock icon in your browser’s address bar. That won’t hide everything, but it protects the actual content of what you’re doing.
Second, a VPN (virtual private network) encrypts your traffic before it leaves your device, which means the Wi-Fi router sees a blob of scrambled data instead of your browsing. Not all VPNs are trustworthy — you’re just moving the trust from the router owner to the VPN company — so do a little research before picking one. That said, a reputable VPN with a no-logs policy is still generally considered a meaningful privacy improvement on public Wi-Fi.
Third, on newer devices, a feature called MAC address randomization sends a fake hardware ID to networks you connect to instead of your real one. This limits how easily networks can track your specific device across different locations. Most modern iPhones and Android phones have this turned on by default, but it’s worth double-checking your settings to confirm.
The bottom line: free Wi-Fi isn’t some neutral utility. Someone owns that router, and connecting to it hands them a real window into your device and your browsing. That’s not a reason to panic — it’s just a reason to know what you’re handing over.