You can usually upload a bank statement on public WiFi safely if the converter's address starts with https, because the file is encrypted between your browser and the site. The network cannot read it. What the café's WiFi cannot do is tell you whether the site itself is trustworthy, so that check still falls to you.
What does HTTPS protect during a public wifi statement upload?
HTTPS protects the content of a public wifi statement upload from everyone else on the network, including the café's router. The file is scrambled in your browser and unscrambled only by the site you are connected to. Someone watching the network sees that you visited a site, not the statement inside.
What the FTC says
The FTC's article on whether public Wi-Fi networks are safe says that, because of the widespread use of encryption, connecting through a public network is usually safe. It suggests looking for a lock symbol or https in the address bar to check a connection, and notes that most mobile apps encrypt too, though that is harder to confirm.
What the network still sees
The network can still see which sites you connect to and how much data you send. A large upload to a converter site at 2 pm is visible as an event. Its contents are not. For most people that is an acceptable trade.
What public wifi encryption cannot check: the converter itself
Public wifi encryption cannot tell you whether the converter on the other end is honest. A lock icon proves the connection is private, not that the site deserves your statement. Scam sites use encryption too, so the file arrives safely at a place that may keep it, sell it or misuse it.
The same FTC article makes this point directly: data may be encrypted on its way to a site but is not safe from scammers operating the site. That is a question about the site, not the network. How to check whether a converter site is legit covers the signs to look for, and the same check applies at home.
Questions the lock cannot answer
- How long does the site keep the file?
- Does it use uploads to train AI models?
- Who runs it, and how do you contact them?
Free sites deserve the most attention here, because they have to earn money somewhere. How free PDF to Excel converters pay their bills explains the usual models.
Fake hotspots and sign-in pages on café wifi
Fake hotspots are the edge case on café wifi. Someone nearby can create a network with a name like the café's, and a sign-in page on any public network can ask for more than it should. Neither breaks HTTPS on its own, but both can push you toward a page that is not what it seems.
Spotting a fake network
Ask staff for the exact network name, and pick that one rather than the strongest signal. Be suspicious of two networks with nearly the same name. If your browser warns that a site's connection is not private, stop. That warning is the main sign that something is sitting between you and the site.
Sign-in pages
Many public networks show a page where you accept terms before getting online. Accepting terms is normal. Entering an email address may be normal. Being asked to install software, a certificate or a profile is not, and you should leave the network.
Steps for a safer statement upload over public wifi
A safer statement upload over public wifi takes a minute of preparation. You confirm the network, check the site address, upload, download the result and close the tab. None of the steps needs special software, though a VPN from a provider you trust adds a layer if you already use one.
- Join the network whose name the staff gave you.
- Type the converter's address yourself or use a bookmark, instead of clicking a link from an email or an ad.
- Check that the address starts with https and shows no certificate warning.
- Upload only the statement you need, not a folder or a year of files.
- Download the converted file, open it to make sure it is complete, and close the tab.
- Sign out of any account you used, and forget the network on your device when you leave.
Skip the email gate
A converter that emails the result to you adds another trip for the file and another copy in your inbox. Tools that work without one, as compared in converting PDF to Excel online with no email required, keep the job in the browser window you are watching.
When should the bank statement upload wait for home?
The bank statement upload should wait for home when the network shows any certificate warning, when you cannot confirm the network's name, or when a sign-in page asks you to install something. It should also wait if you are on a shared or library computer, because the risk then is the machine, not the WiFi.
Shared computers are the bigger risk
A public computer may keep your downloads, remember files in its browser, or run software you cannot see. Encryption on the network does not help with any of that. Use your own laptop or phone, or wait.
When it is fine to go ahead
On your own device, on a network you confirmed, with a site you have already checked, a café upload carries about the same risk as one at home. CheapBankConvert states that statements are encrypted in transit and at rest and deleted after you download your file. It is in early access, so check the homepage for when you can use it.