SentryFi- SentryFi
- WiFi guides
- Evil twin WiFi
Explainer
What is an evil twin WiFi?
An evil twin is a fake WiFi hotspot dressed up as a real one. It’s one of the few public WiFi risks that still works well, because it targets people, not encryption.
An evil twin is a fake WiFi access point that copies the name of a trusted network, often with a stronger signal, so your phone joins it instead of the real one (CISA). Once you’re on it, the operator can show a fake sign-in page, watch which services you connect to and try to redirect address lookups. Avoid it by confirming the exact network name, turning off Auto-Join and never entering passwords or card details on a WiFi sign-in page.
What an evil twin can do
| Fake sign-in page | Ask for an email password, social login or card number “to get online”. |
|---|---|
| Redirect lookups (DNS) | Send a familiar address to a different server; certificate checks usually catch this if you don’t ignore warnings. |
| See connection metadata | Which servers you connect to, not the content of HTTPS pages and apps. |
| Read unencrypted traffic | Anything sent over plain http or by apps that don’t encrypt. |
What it usually can’t do
- Read your encrypted banking or messaging traffic, unless you ignore a certificate warning.
- Take over your phone just because you joined it.
How to spot and avoid one
- Confirm the exact network name with staff or the venue’s website (CISA’s advice for public hotspots).
- Be wary of two networks with the same or nearly the same name.
- Turn off Auto-Join for public networks so your phone doesn’t silently join a copy later.
- Never type passwords or card details on a WiFi sign-in page for free access.
- Check the network: unexpected DNS answers, certificate problems or a proxy are warning signs.
- If in doubt, use mobile data.
No app can prove which of two networks with the same name is real. SentryFi looks for the signs an evil twin tends to leave, such as a suspicious sign-in page, DNS answers that differ from trusted DNS and certificate problems, and with Pro it can tell you when a network you trust looks different from last time.
Frequently asked questions
How do I know if I’m connected to an evil twin?
Signs include a sign-in page that asks for more than usual, certificate warnings on familiar sites, unexpected DNS answers, or a network that appears twice. None is proof, but any of them is a reason to disconnect.
Does a VPN protect against evil twins?
A VPN encrypts traffic after it connects, which limits what a fake hotspot can see or change. It doesn’t stop you from typing details into a fake sign-in page before the VPN starts.
Can an evil twin have a password?
Yes. If the real network’s password is posted on the wall, anyone can set up a copy with the same name and password.
