Open the Wi-Fi settings on a phone you’ve had for a few years and look at the list of networks it remembers. There’s a good chance you’ll find hotels you stayed in once, an airport lounge, a café you visited on vacation and a friend’s old router. Your phone has held on to all of them, and it’s ready to reconnect the moment it sees one again.

The National Security Agency thinks you should clean that list out. Its one-page Mobile Device Best Practices guide puts it in three short instructions: “DO NOT connect to public Wi-Fi networks. Disable Wi-Fi when unneeded. Delete unused Wi-Fi networks.”

Why a saved network is a risk

The reason comes down to how phones behave by default. Google’s Android help page spells it out: “When you have Wi-Fi turned on, your device automatically connects to nearby Wi-Fi networks you’ve connected to before.” iPhones do the same through a setting Apple calls Auto-Join.

That is convenient at home and at work. It is less helpful when someone has set up a network designed to look familiar. In its July 2021 information sheet Securing Wireless Devices in Public Settings, the NSA warns that “a malicious actor can set up a fake access point, also known as an evil twin, to mimic the nearby expected public WiFi.” The agency says this can give the attacker access to the data sent over that connection.

Put those two facts together and the problem is clear. The longer the list of public networks your phone remembers, the more names an attacker could copy to get your phone to connect automatically, without you tapping anything.

What the NSA tells people to do

The 2021 information sheet goes into more detail than the one-page guide. Among its recommendations for using Wi-Fi in public:

“Delete unused Wi-Fi networks.” This is the same instruction as in the mobile guide. If you’re not going back to that hotel, your phone doesn’t need to remember it.

“Log out of the public Wi-Fi network and ‘Forget’ the access point when finished using it.” In other words, don’t wait for the list to build up. Remove a public network as soon as you’re done with it.

“Disable Wi-Fi network autoconnect.” Turning off automatic joining means your phone asks before connecting, rather than assuming a familiar name is safe.

The NSA also recommends that you “ensure the device is connecting to the correct network,” that you not set public Wi-Fi networks to be trusted networks, and that you “disable Wi-Fi when not in use.”

These guides were written with government employees in mind, and some of the advice, like never using public Wi-Fi at all, goes further than most people will. But clearing old networks is simple for anyone.

How to delete saved networks on an iPhone

Apple’s support page on how to forget a Wi-Fi network lists the steps. Open Settings, then tap Wi-Fi. “Tap Edit in the corner of the screen to view the networks known to your device.” Tap the More Info button next to a network, then “tap Forget This Network, then tap Forget to confirm.”

Apple says that afterward, “unless you manually join the network again, your device no longer automatically joins the network.” Forgetting removes the network and its password, but your phone will still show the network as available if it’s nearby.

One thing worth knowing: Apple says that for devices using iCloud Keychain with the same Apple Account, “forgetting a Wi-Fi network on one device causes the other devices to forget the network as well.” Removing a network from your iPhone can also remove it from your iPad and Mac.

If you want to keep a network but stop your phone from joining it on its own, Apple offers a middle option. On the same More Info screen, turn off Auto-Join.

How to delete saved networks on Android

According to Google, the steps are: open your device’s Settings app, tap Network & internet and then Internet, “touch and hold a saved network,” and tap Forget. Google notes that some of the steps on its page work only on Android 12 and up, so older phones may label things differently.

A two-minute habit

Your home and work networks can stay. Everything else is worth a second look. Go through the list, remove the hotels, airports, cafés and anything you don’t recognize, and make a habit of forgetting public networks as soon as you leave them. It takes a couple of minutes, and it gives your phone fewer reasons to trust a network it shouldn’t.