You connect to free coffee-shop Wi-Fi, log into your email, and everything looks normal. But if someone has quietly positioned themselves between your device and the internet, they can read or alter what you send. That is a man-in-the-middle attack, and it turns an ordinary connection into an open window. Our GetMyPassword team explains what it is and how to stay protected.
What a man-in-the-middle attack is
In a man-in-the-middle attack, an attacker secretly relays and possibly alters the communication between two parties who believe they are talking directly. They sit between you and the website or service, intercepting the data as it passes. From that position they can read passwords, capture session cookies, change payment details, or inject malicious content. The two sides often notice nothing, because the conversation still appears to work — the attacker is simply listening, and sometimes editing, in the middle.
Common ways it happens
- Rogue or “evil twin” Wi-Fi set up to look like a legitimate hotspot.
- Unsecured public Wi-Fi where traffic can be observed.
- Fake or stripped security that downgrades an encrypted connection to plain text.
- Spoofed websites that proxy the real one while capturing what you enter.
- Compromised routers that quietly reroute your traffic.
How encryption stops it
The strongest everyday defense is encryption in transit. When a site uses HTTPS, the data between your browser and the server is scrambled, so an interceptor sees only unreadable traffic, not your password. That is why the padlock and the “https” prefix matter, and why browser warnings about an invalid certificate should never be ignored — a certificate error can mean someone is trying to sit in the middle. Encryption does not stop an attacker from being on the network, but it stops them from making sense of what they capture.
An attacker on the same network can hear the conversation; encryption makes sure all they hear is noise. The padlock is not decoration — it is the wall between your password and the person in the middle.
How to protect yourself
Look for HTTPS before entering anything sensitive, and never click past certificate warnings. Avoid logging into important accounts on unknown public Wi-Fi, or use a trusted VPN to encrypt your whole connection. Keep your devices and browser updated, and prefer your own mobile data for banking. Turn on two-factor authentication and use a unique password from our password generator for every account, so that even a captured credential cannot be reused elsewhere.
Frequently asked questions
What is a man-in-the-middle attack?
It is an attack where someone secretly relays and possibly alters the communication between you and a website or service. From the middle they can read passwords, capture session cookies, or change details, while both sides believe they are talking directly.
How does HTTPS protect me?
HTTPS encrypts the data between your browser and the server, so an interceptor sees only scrambled traffic instead of your password. Always check for the padlock and never ignore certificate warnings, which can signal an attack.
Is public Wi-Fi safe to use?
Public Wi-Fi can expose your traffic to interception. Avoid logging into sensitive accounts on it, use a trusted VPN to encrypt your connection, or use your own mobile data. Combined with HTTPS and two-factor authentication, the risk drops sharply.