The lesson holds for Windows users too. The risk is easy to overstate, though, so this article separates what is documented from what is hype.
Where each device keeps its list
Apple's support documentation describes the iPhone and iPad route this way:
- Open Settings, tap Wi-Fi, then tap Edit. This is Apple's documented path, but the text I retrieved for Apple's own page is in the packet, not the search results, so I'm paraphrasing it here.
- Authenticate with your passcode, Face ID or Touch ID to see the networks the device previously joined.
- Tap the info button, then the Password field, to reveal a saved password.
- In iOS 18, the Passwords app also has a Wi-Fi section.
Other platforms:
- Mac: System Settings > Wi-Fi > Advanced lists Known Networks. Per Apple, you can remove a network, change auto-join, or copy a password there. The copy option may not be available for some networks.
- Windows: Settings > Network & internet > Wi-Fi > Manage known networks. Select a network and choose Forget.
- Android: the path varies by manufacturer, so look for Saved networks under Network & internet and expect differences.
One Apple detail matters for people with several devices. For devices sharing an Apple Account through iCloud Keychain, Apple says forgetting a network on one device makes the others forget it too.
What a saved list reveals
A single entry like "Home" says little. A set of distinctive names forms a trail: past hotels, old homes, workplaces, a former car's infotainment system, a friend's hotspot.
University of Hamburg researchers studied Wi-Fi probe requests in a field experiment. They found that users, probably by accident, typed passwords, email addresses, names and holiday locations into the network name field. That is a result of the researchers' experiment, not a universal rate. It's also a good reason never to put personal information in your own SSID.
The WiGLE point in the original story is plausible but conditional. WiGLE is a crowdsourced map of Wi-Fi networks. A generic name like "Guest" would return a useless pile of matches. A distinctive name might be traceable. That's a possibility, not a guarantee that any given name resolves to an address.
Does your device broadcast the list?
This is where many headlines go wrong.
- The Hamburg paper reports that around 23% of the probe requests it observed contained names of networks the devices had joined before. That reflects the devices and operating systems in the experiment, not today's phones.
- Apple's platform security documentation says that when a network is configured as hidden, the device sends a probe containing its SSID. Otherwise it does not include the name.
- Apple's router guidance recommends leaving your network's Hidden setting disabled. It says hiding the name doesn't conceal the network from detection or secure it. It adds that using a hidden network might expose information that can identify you and the hidden networks you use, such as your home network.
- The Android 8 claim in the original story is version-specific. According to the Hamburg dissertation, Android 8 treated manually added networks as hidden by default. That is historical behavior, not a description of current Android.
The takeaway is that a current iPhone isn't announcing your travel history to strangers. Hidden networks are the documented exception. Old or unsupported gear may behave differently, but nothing here establishes which specific products still do.
Lookalike networks and auto-join
A network name doesn't prove which router is behind it. Any access point can advertise a familiar name, which is the basis of "evil twin" attacks.
The original piece says this mostly works against open networks. I'd soften that. Whether a device connects, and what an attacker can do, depends on the network's security setup, saved credentials and how the device behaves. Copying your home SSID doesn't hand someone your home password.
Open hotel and café networks sitting in your list are still the sensible place to start cleaning. Apple's router guidance points to the same trade-offs. It warns that open networks let anyone join and monitor traffic.
Apple also flags carrier Wi-Fi. Those entries appear under Managed Networks on iPhone and the section isn't editable. If you see a privacy warning there, your cellular identity could be exposed if the device auto-joined a malicious hotspot impersonating that network. You can still open the network's info and switch off Auto-Join.
The Windows angle: saved keys are readable locally
Windows keeps saved wireless profiles, and its command line can show the password in plain text. The netsh wlan show profile name="NETWORK" key=clear syntax is widely documented by Windows publications such as Windows Central and How-To Geek. Look for the Key Content field in the output. Microsoft's own netsh wlan reference documents the related export option, netsh wlan export profile key=clear, which writes the key in clear text into the exported file.
Be precise about the threat. This is a local-access risk. Someone needs to be at your unlocked PC, usually with enough permissions. A stranger can't pull your password just because your laptop once joined "Cafe-WiFi." The practical points:
- Lock your PC when you step away.
- Treat exported profile files as sensitive and don't leave them in shared folders.
- Prefer a sign-in that protects the machine, since the Wi-Fi key is only as safe as the account that can read it.
How to clean up
- Review every device you still use. One device's list may not match another's, and managed profiles can differ.
- Forget networks you won't use again.
- iPhone: Settings > Wi-Fi > Edit, tap the info button, then Forget This Network.
- Mac: Wi-Fi > Advanced, then Remove From List.
- Windows: Manage known networks > Forget. Reconnecting later means selecting the network again and entering the password.
- Keep a public network but turn off Auto-Join. Apple says the network and password stay saved, but the device won't rejoin on its own. You can still join manually.
- Don't hide your own SSID as a privacy fix. Use WPA3 Personal, or WPA2/WPA3 Transitional if you have older devices, with a strong password. Apple's router guidance lists those as the recommended modes.
- Pick a distinctive but non-personal network name. Apple advises avoiding default names like linksys or netgear because devices may auto-connect to other networks with the same name. Keep your name, address and passwords out of it.
- Check your hotspot name. On iPhone it comes from the device name, which is often your first name.
- Update everything, including the neglected smart plug.
The big reset, with a caveat
The original piece suggests Reset Network Settings on iPhone for a clean slate. Apple's iPhone guide says it removes previously used networks and VPN settings that were not installed by a configuration profile or mobile device management. So it isn't a total wipe on a work phone, and it's broader than deleting old Wi-Fi entries. On Windows, Microsoft's troubleshooting guide treats network reset as a last resort for connection problems. It removes and reinstalls network adapters, may need VPN client software set up again, and can set known connections to a public network profile.
Bottom line
Your saved-network list is a breadcrumb trail and a stash of credentials, but the story isn't "your phone shouts your history to the street." Modern behavior is more restrained, with hidden networks as the documented exception. The realistic risks are old entries that auto-join, open public networks, and anyone with local access to an unlocked device. A few minutes of pruning and an Auto-Join audit address most of that. Open your Wi-Fi settings, or Manage known networks on Windows, and see what your devices still trust.