Public Wi-Fi at airports, hotels and cafés is shared with strangers and run by someone you don't know, so other people on it, or whoever operates it, may be able to see which sites you visit, tamper with your connection or trick you into joining a fake hotspot. HTTPS protects the contents of most websites, but not everything: the names of the sites you visit, apps that don't encrypt properly and your device's exposure on the local network remain. A VPN encrypts all traffic between your device and the VPN server, so the local network sees only one encrypted connection. It won't protect you from phishing or malware, so it is one layer, not the whole answer.
What can go wrong on public Wi-Fi
Fake hotspots
Anyone can set up a hotspot called "Airport_Free_WiFi" or name it after the café you're sitting in. These "evil twin" networks look identical to the real thing. Once you join, the operator controls your connection: they can watch your traffic, redirect you, or show fake sign-in pages.
Open networks and shared passwords
A network with no password sends Wi-Fi traffic without encryption over the air, unless both the network and your device support newer "enhanced open" protection. A password printed on the café wall isn't much better: everyone in the room knows it, so it doesn't keep other customers out of the network.
DNS tampering and redirects
Before your device connects to a website, it looks up the site's address using DNS. On a network you don't control, those lookups can be answered falsely, sending you to a look-alike site or injecting adverts.
Metadata leaks
Even when a site uses HTTPS, the local network can often see which sites you visit through DNS lookups and the name your browser announces at the start of a secure connection. That reveals a lot: your bank, your health provider, your employer's tools.
Your device on a shared network
On public Wi-Fi, your laptop or phone is on the same local network as everyone else. File sharing, printer sharing or other services left switched on can be visible to strangers.
What HTTPS already protects, and what it doesn't
HTTPS is a huge improvement, and most major sites use it. Here is what changes when you add a VPN on top.
| What's at stake | On public Wi-Fi, HTTPS only | With a VPN as well |
|---|---|---|
| Page content and passwords on HTTPS sites | Encrypted | Encrypted, inside a second encrypted tunnel |
| Which sites you visit | Often visible through DNS and site names | Hidden from the local network |
| Apps that send data without proper encryption | Visible and alterable | Encrypted between you and the VPN server |
| DNS lookups | Can be read or falsified locally | Sent through the tunnel |
| The IP address websites see | The hotspot's address | The VPN server's address |
| Your device on the local network | Visible to others on the network | Still on the network; a VPN doesn't hide it |
That last row matters. A VPN protects traffic leaving your device; it doesn't turn off the services your device offers to the local network. That's a job for your device's own settings.
What a VPN does on public Wi-Fi
When you connect a VPN, your device builds an encrypted tunnel to the VPN server, and all your traffic travels inside it. To the hotspot operator and anyone else on the network, you're sending one stream of encrypted data to one server. They can't see which sites you open, can't read unencrypted app traffic and can't falsify your DNS lookups.
The trade-off is trust: your traffic now leaves the internet through your VPN provider instead of the café's network, so choose a provider carefully. Our article on VPN privacy basics explains what a VPN hides and what it doesn't, and VPN vs proxy explains why a browser proxy isn't the same protection.
What a VPN does not do
- It doesn't stop phishing. If you type your password into a fake login page, a VPN can't save it.
- It doesn't remove malware already on your device.
- It doesn't fix weak or reused passwords. Use a password manager and two-factor authentication.
- It doesn't stop shoulder surfing. Someone watching your screen in a busy lounge sees what you see.
Airport, hotel and café: step by step
- Confirm the network name with staff or official signs before joining.
- Complete the sign-in page first. Many hotel and airport networks show a "captive portal" for accepting terms or entering a room number. Finish that, then connect your VPN.
- Connect the VPN before anything sensitive. Do it before opening email, banking or work apps.
- Turn off sharing. On Windows, mark the network as public. On a Mac, turn off file sharing and set AirDrop to contacts only. On phones, turn off nearby sharing you don't need.
- Forget the network afterwards and turn off auto-join, so your device doesn't reconnect to a look-alike later.
- Use your phone's hotspot for the most sensitive tasks if you have a good mobile signal. Your own hotspot is a network only you control.
When hotel or airport Wi-Fi blocks VPNs
Some public networks block common VPN protocols or ports, either deliberately or through strict default settings. Classic protocols such as OpenVPN, WireGuard and IKEv2 have recognisable traffic patterns, which makes them easy to filter. ZoltVPN's CyberPort AI chooses between 10 connection models based on your location, your provider and live performance, switches automatically when one is blocked or slow, and remembers what works on each network, so the same hotel Wi-Fi reconnects faster the next morning. Read how this works differently from network to network in VPN on mobile data vs Wi-Fi.
FAQ
Is it safe to use online banking on public Wi-Fi?
Banking sites use HTTPS, which protects the content. The remaining risks are fake hotspots, phishing pages and the network seeing which bank you use. Connecting a VPN first, checking the network name and using your bank's official app reduces those risks.
Does a VPN slow down public Wi-Fi?
A little overhead is normal, but on a busy public network the Wi-Fi itself is usually the bottleneck. On networks that throttle certain traffic, a VPN can even be faster.
Do I need a VPN on password-protected hotel Wi-Fi?
Yes. A shared password keeps out passers-by, not the other guests who were given the same password.
Is my phone's hotspot safer than café Wi-Fi?
Generally, yes, because you control it and only your devices join. A VPN still adds protection for traffic leaving your phone.
Travel safer: download ZoltVPN before your next trip and try it free for 7 days, no card needed.
