Is public Wi-Fi safe? How to stay private on airport, hotel, and café networks

Free Wi-Fi at an airport gate, a hotel, or a café is convenient, and most of the time nothing bad happens. But a public network is a place where you do not control the router, you do not know the other people connected, and you often cannot even be sure the network is the one it claims to be. A few habits close most of that gap.

What is actually risky on public Wi-Fi

Most websites and apps now use HTTPS, which encrypts the content of your pages and logins between your device and the site. That is a big improvement over a decade ago, and it means "someone will read all my passwords" is no longer the typical risk. The real risks are more specific:

1. Fake or look-alike hotspots. Anyone can create a network called "Airport_Free_WiFi" or "Hotel Guest". If your device joins it, the person running it sits between you and the internet. This is often called an evil twin.
2. Fake login pages. Many public networks show a sign-in page (a captive portal) before they let you online. A rogue network can show a portal that asks for your email password, card number, or a "security app" download.
3. Other devices on the same network. On a shared network, other guests may be able to see your device and try to reach file sharing, printers, or other services you left open.
4. What the network can still see. Even with HTTPS, the network operator can usually see which domains you look up and connect to, when, and how much data you move. Some older apps and devices still send data without encryption at all.
5. Shared passwords. A Wi-Fi password printed on a card at reception keeps strangers outside the building off the network, but every guest inside knows it too.

Before you connect

• Confirm the exact network name. Ask staff or check the official sign. If you see two similar names, do not guess.
• Prefer your phone's hotspot for anything sensitive. Mobile data from your own SIM is usually a safer path than shared Wi-Fi for banking, work logins, or account recovery.
• Turn off auto-join for public networks. Phones and laptops happily reconnect to any network with a familiar name, which is exactly what a fake hotspot relies on.

When you connect

1. Treat the sign-in page with suspicion. A legitimate portal usually asks for a room number, a voucher code, or just a click to accept terms. Close it if it asks for your email password, payment details for a "free" network, or wants you to install something.
2. Mark the network as public. On Windows, choose the Public network profile so file and printer sharing stay off. On Mac, keep file sharing and similar services off unless you need them.
3. Turn on your VPN right after the portal. Finish the sign-in page first, then connect. If the portal will not load while the VPN is on, disconnect, complete the portal, and reconnect before you open email or anything else.
4. Keep the kill switch on. Public Wi-Fi drops and reconnects often. A kill switch blocks traffic while the tunnel is down, so a reconnect does not quietly send your traffic out on the open network.

What a VPN does here, and what it does not

What it does: A VPN encrypts traffic between your device and the VPN server. The hotspot operator and other people on the network see that you are connected to a VPN, but not which sites you visit or what you send. Your DNS lookups should also travel inside the tunnel, which hides the list of domains you visit from the local network. That removes most of what a fake hotspot or a curious network admin can learn.

What it does not do: A VPN does not make a phishing page safe. If you type your password into a fake login form, the VPN will deliver it to the attacker over an encrypted connection. It does not remove malware, and it does not make you anonymous to sites where you are logged in. Good judgment about links, downloads, and sign-in pages still matters.

Small habits that help

• Never click through certificate warnings. If your browser says the connection is not private, stop. On public Wi-Fi that warning can be a sign of interception.
• Keep your system and browser updated. Many network attacks rely on old, known bugs.
• Use two-factor authentication on email and important accounts, so a stolen password alone is not enough.
• Forget the network when you leave. It stops your device from joining a copy of it later.
• Run a quick check. After connecting the VPN, a two-minute IP and DNS leak test confirms your traffic is going where you expect.

Quick checklist

1. Confirm the network name with staff or an official sign.
2. Use your phone's hotspot for banking and account recovery when you can.
3. Only give the sign-in page what it legitimately needs.
4. Set the network to public and keep sharing off.
5. Connect the VPN right after the portal and keep the kill switch on.
6. Never ignore browser certificate warnings.
7. Forget the network when you are done.

FAQ

Is hotel Wi-Fi with a password safe? It is safer than a fully open network, because people outside the building cannot join easily. But every guest has the same password, so treat it like any other shared network and use a VPN.

Is HTTPS enough on public Wi-Fi? HTTPS protects the content of most websites, which is a big deal. It does not hide which sites you visit, it does not protect apps that skip encryption, and it does not stop fake hotspots or fake sign-in pages. A VPN covers the network side; your own care covers the rest.

Should I just use mobile data instead? For sensitive tasks, often yes. Your own mobile connection is not shared with strangers in the same room. A VPN is still useful on mobile data if you do not want your carrier or the local network to see which sites you use.

Do I need a VPN on every device? Use it on any device you take onto public networks, usually your phone and laptop. BetterVPN's Standard plan covers up to 10 devices and Dedicated Server covers up to 30, so one account can protect the phone, laptop, and tablet you travel with. See pricing for details.