What can someone on your Wi-Fi actually see?
Shared Wi-Fi does not automatically reveal every message. Separate visible metadata from encrypted content.
A shared network is not a magic viewing window
Simply joining the same Wi-Fi does not let someone read every message on every phone. Modern networks and applications use several protections. What an observer can see depends on their position, the network configuration and the protocols in use.
A device may communicate directly with an access point rather than broadcasting useful application content to every nearby client. Client isolation, switched networks and encryption affect what is observable.
The useful lesson: content versus metadata
Unencrypted HTTP can expose application content to an observer who is able to capture the relevant traffic. HTTPS encrypts the connection between a client and the TLS endpoint. An observer may still learn information from timing, destination addresses or other metadata. They do not automatically receive the plaintext body of a properly protected HTTPS request.
Encrypted messaging adds another distinction: transport encryption and end-to-end encryption protect different boundaries. End-to-end encryption does not protect an unlocked device from someone who can read its screen or an authorised linked session.
Build a controlled comparison
Use a separate lab network, your own devices and a deliberately created test page. Send an obvious dummy value over a local HTTP connection. Compare the result with an HTTPS version whose certificate your device correctly trusts. Show exactly where the capture occurs and what it contains.
Never disable certificate validation and present that as the behaviour of an ordinary secure connection. Do not collect household traffic or reuse real account credentials in a demonstration.
Practical defence
Keep devices updated, avoid ignoring certificate warnings, and use reputable applications with secure transport. Review router updates and administrator access. A VPN can protect a particular network path, but it does not make a malicious website trustworthy or repair an already compromised phone.