Is It Safe to Send Files Over Public Wi-Fi?

You’re sitting in a cafe with a folder you actually need to send — trip photos, a PDF someone is waiting on, a video that will bounce off email. The only network is the one on the chalkboard. No password, or a password written under the specials. Everyone in the room is on it. You hesitate. That hesitation is reasonable.

Public Wi-Fi is convenient and easy to watch. The useful question is not “is cafe Wi-Fi trustworthy?” It isn’t. The useful question is what the network can see when you send a file, and whether that file has to live on someone else’s server when you’re done.

What “unsafe” actually means on public Wi-Fi

People mash three different problems together.

Someone on the same network can capture traffic. On an open or loosely segmented cafe network, other clients may be able to sniff packets. If you send a file in the clear — old Windows file sharing, an http:// upload, a tool that never turned on encryption — those packets are the file.

The file is uploaded to a third party. Google Drive, Dropbox, and WeTransfer encrypt the hop to their servers (HTTPS). That stops the person on the next stool from reading the upload. It does not stop the file from sitting in a bucket you don’t control, often until a link expires or you remember to delete it.

You send it to the wrong person. Encryption cannot undo a wrong nearby device, a nickname typo, or a share link pasted into the wrong chat.

Only the first problem is unique to public Wi-Fi. The other two happen on home Wi-Fi too. “Just use HTTPS” only covers the first.

What a sniffer actually gets

On a typical cafe or airport network, other devices can sometimes see that you are talking to another machine, and roughly how much data is moving. What they cannot see — if the transfer is end-to-end encrypted — is the contents.

Likz Drop is a free app for Windows, macOS, Android, and iPhone. It encrypts the file on the sending device before anything leaves. The key is derived from the one-time transfer token with BLAKE3. Each 1 MiB chunk is sealed with ChaCha20-Poly1305. A captured packet is authenticated ciphertext, not a JPEG you can rename and open.

That holds on every live path:

Same Wi-Fi, nearby discovery. Devices on the LAN appear automatically. The file moves at full local Wi-Fi speed, device to device. Cafe Wi-Fi is still the network under the packets, but Likz servers are not in the file path, and nothing is stored as a cloud file afterward.
Different networks, send by nickname. One of you is on the cafe SSID, the other is on cellular or in another city. You send to their nickname. If a relay is needed, it only forwards already-encrypted bytes. It does not decrypt them and does not keep a downloadable copy after the stream ends.
No router at all. Android and iPhone can send offline — no cafe Wi-Fi, no internet, no router. Use this when you don’t want the lounge network in the path.

A browser share link is a live send, not a parked file. The link is private. The recipient does not need the app. The link stays live only while you are sharing. Stop sharing and it is gone immediately — not a fixed 24-hour URL that anyone who forwarded it can reopen later.

Guest mode needs no sign-up. If the cafe Wi-Fi drops mid-send, the transfer can resume instead of starting over.

The catch: client isolation

Many public networks turn on client isolation (sometimes called AP isolation). The access point lets you reach the internet and blocks two laptops on the same SSID from talking to each other. That is a reasonable defense against the next table browsing your shared folders. It also means nearby discovery can come up empty even though you both have “Airport_Free” and full bars.

If nearby devices do not appear:

Send by nickname — the transfer leaves the isolated LAN over the encrypted relay.
Skip the cafe network and use the offline Android ↔ iPhone path.
Create a share link and have them download in a browser while you stay in the app.

You do not have to fight the cafe’s isolation, stand up a personal hotspot you don’t want, or upload the folder to Drive “just this once.”

This is also why same-LAN-only tools go quiet in hotels and airports. LocalSend, classic Snapdrop, and PairDrop are honest same-network tools. If the access point blocks client-to-client traffic, they cannot see the other device. That is not a smear — it is why a public-Wi-Fi send often needs a path that is not “same LAN or nothing.” AirDrop and Quick Share use their own nearby radios and generally do not depend on the cafe router, but they are locked to Apple and (mostly) Android/Windows. None of them is a Windows–Mac–iPhone–Android answer.

A cloud link is not the safer default

A Drive or WeTransfer link feels grown-up on public Wi-Fi because the browser padlock is familiar. HTTPS does protect the upload from the next stool. It does not change these facts:

The file is stored on someone else’s disk, at least for a while.
Anyone with the link — or access to the account — gets the file.
A large video or a RAW folder pays the bandwidth tax twice, on a network that is already slow and often stuck behind a captive portal.
Free tiers cap size and expire links. That is a product choice, not a security feature.

A live encrypted send, or a share link that dies when you stop, leaves nothing sitting in a bucket for the next person who inherits a forwarded URL.

Unencrypted SMB / Windows “share this folder” on public Wi-Fi is the worst of the common options. You are advertising a file share on a network you do not control. Don’t.

A VPN hides your traffic from the cafe operator on the way to a VPN server. It does not encrypt a file you then upload in the clear, and it does not stop a cloud host from storing the copy. If the transfer is already end-to-end encrypted, a VPN is optional.

A short checklist before you hit send

Confirm the recipient: the nearby device name, the nickname, or the person you are handing the link to. Encryption cannot save a wrong destination.
If the file is sensitive and you do not need the internet, prefer the offline phone path or a personal hotspot you control.
If you stay on public Wi-Fi, use an end-to-end encrypted transfer, not an open share.
Do not leave a share link sitting in a chat after you are done. Stop sharing so the link dies with the session.
A compromised laptop is still a compromised laptop. Encryption in transit does not clean malware on either end. No method is 100% secure against a device you no longer trust, a phishing page, or a tap on the wrong name.

Likz Drop is free forever for personal, school, and charity use. If the send is paid work — client media, a deliverable, sharing with teammates — that is the Pro plan: $20 per user per month, or $200 per user per year.

How to send from a cafe without the usual cloud hop

Download Likz Drop on your device. Guest mode, no account.
If the other person is next to you and they appear under nearby devices, pick them and send.
If the nearby list is empty (client isolation), send by nickname or start a share link.
They accept in the app, or open the link in a browser. The original file arrives — not a compressed preview, not a Drive copy.
Stop sharing when they are done.

Nearby uses the LAN. Nickname covers different networks. The share link covers “they have no app.” Offline covers “I don’t want this cafe in the path.” Send the folder you mean if you want the other side to keep your organization. If you use a share link, say that it is live now, not later tonight.

FAQ

Can someone on cafe Wi-Fi open the file I am sending? Not if the transfer is end-to-end encrypted. On Likz Drop, each chunk is sealed with ChaCha20-Poly1305 before it leaves your device. A sniffer can see that data is moving, not the photos inside.

Why don’t I see the other phone when we are both on the same public Wi-Fi? A lot of cafes, hotels, and airports isolate clients from each other. Nearby LAN discovery needs that local path. Send by nickname, use a share link, or go offline Android ↔ iPhone and skip the public network.

Is a Google Drive link safer on public Wi-Fi? The upload to Google is encrypted. The file then lives in your Drive. That is a different trade: transit protection plus a stored copy. A live encrypted send never leaves a cloud file behind.

Public Wi-Fi will keep being the only network in the room. You do not have to trust it. Encrypt the file on the device, send it to the right person, and don’t leave a copy sitting on a server because the cafe password was written on a napkin.