So, you were at the park joined the free public WiFi?

Can someone easily see every keystroke you just entered?

No.

Worst case: you visited a website without HTTPS, sent information, someone had a packet sniffer running and they saw all the info you sent. If you typed something without submitting a form, it wouldn’t be caught.

Best case,you visited an encrypted website and it didn’t matter at all.

Long story, it starts with radio waves.

Those radio waves get sent to your router. The kind Xfinity is keen to sell you on but doesn’t seem to care much about after your contract ends. That router is somewhere close to the park.

Once the radio waves from your laptop hit it, it will look at the address you’re trying to reach and route it to the right server. The crazy thing about routers, like the one in your house, is that it’s connected via wire (usually telephone wires) to the physical serve it’s sending it to. Your local data center has entered the chat. In some remote cases this happens via satellite instead.

Now, can anyone see the info carried in these radio waves?

That’s all determined by the website you visited and whether they enforce HTTP or HTTPS.

Let’s say you access Amazon. Can someone see what you did?

No. Amazon uses HTTPS, so before your browser and Amazon’s server exchange anything, they scramble it.

Quick sidebar: a website is really just hypertext: text with clickable links baked in, letting you jump from page to page instead of reading top to bottom. HTTP is the protocol your browser uses to fetch that hypertext. On its own, HTTP does zero scrambling. It hands your data over in plain, readable text.

If a site uses plain HTTP, anything you type and submit, a search, a login, a comment, can be seen. Just typing a URL and not hitting enter? Nothing’s gone anywhere yet, so there’s nothing to intercept. The danger only kicks in the moment data is actually sent.

Here’s how HTTPS avoids that. The first time your browser connects to an HTTPS site, the server hands over a certificate — proof of who it is, issued by a trusted authority — along with a key. Your browser and the server use that to agree on a shared secret, without ever exposing it in the open. From then on, everything sent between you gets scrambled before it leaves your device, and unscrambled only once it lands.

That’s what the little lock icon on your browser represents, the superhero powers of HTTPS.

So now, you can use that public WiFi in some form of peace; at minimum informed.