Depends of what the password is used for? If the CG is using a WiFi captive portal, a splash page requiring a password, than the connection is likely not secure and just used for WiFi access. If the password is a WiFi encryption key, than the wireless connection is secure up to the CG's router. At that point, it is possible for the CG and their ISP to monitor your web session activities.
Bill paying sites use secure browser SSL(https://) connections which is encrpted up to their web servers. So is secure whether you are using an encrypted CG WiFi, mobile data, or an open public connection.
For an extra measure of security when paying bills online, open a separate browser page, not a tab to log-in. Pay your bill, and log-out. Don't stay logged in while surfing. SSL browser protocols are secure. And the few attempted exploits appear to revolve around session spoofing due to a misconfigured secure server- not setting secure cookies. Do the log-in, pay bill, and log-out and you're fine.
Most all free webmail sites use SSL for both log-in and sessions, so secure when connected to even unencrypted public WiFi. For websites that don't use SSL sessions, you can add an extra layer of protection by using a secure VPN web proxy service, such as the free
vpnbook.com or
cyberghostvpn.com. This would encrypt your web surfing up to the VPN proxy service. Well past the CG's router and their ISP, so not able to intercept or track your web surfing session activities.