Public networks are unencrypted and can be monitored by attackers.
Public WiFi at cafes, airports, hotels, and libraries is convenient and risky. Any device connected to the same unencrypted network can potentially intercept traffic from other devices. This is not theoretical — tools for doing so are freely available and require minimal technical knowledge to use.
An evil twin attack is particularly effective: an attacker creates a wireless hotspot with a name identical to the legitimate one — "Airport Free WiFi" — and a stronger signal. Your device connects automatically or you choose it from the list. All your traffic now flows through the attacker's device.
HTTPS protects the content of your traffic even on an untrusted network — an attacker can see that you connected to your bank but not the data you sent. However, unencrypted HTTP traffic, and any information leaked through app traffic, remains exposed.
Practical habits for public WiFi: use a VPN to encrypt all traffic before it leaves your device, avoid accessing banking or sensitive accounts, disable automatic connection to open networks, and when done, tell your device to "forget" the network so it does not reconnect automatically.