Why you need a VPN on public Wi-Fi

A train station, an airport, a hotel, a coffee shop: everywhere you go, a free public Wi-Fi network is waiting. Convenient, but these open networks are also a favorite playground for bad actors. The good news is that a VPN on public Wi-Fi neutralizes most of the risk, as long as you understand what it actually protects and what it does not. Here are the real threats, exactly how the encryption works, and the smart habits to adopt when you travel.

What are the real risks of public Wi-Fi?

Let’s be honest up front: public Wi-Fi is far safer than it was ten years ago. Today, more than 95% of web traffic runs over HTTPS, browsers warn you about unsecured sites, and banking apps are built to resist hostile networks. The old line, “anyone can steal your password on the coffee shop Wi-Fi,” is largely outdated. But two attack vectors are still very much alive, and that is exactly where a VPN earns its place. Here is how an open network exposes you, step by step.

Keep this in mind: the danger comes less from the cafe itself than from the possibility that a third party manipulates the network. Let’s break down the two most common techniques.

The evil twin hotspot, the number one threat

This is the most concrete attack in 2026. The idea: an attacker sets up a portable access point and names it exactly like the legitimate network, for example “Airport_Free_WiFi” or “Hotel_Guest”. Your phone, which can’t tell the real from the fake, connects to it, sometimes automatically. All your traffic then flows through the attacker’s machine, which can observe, redirect, or try to trap your connections through a fake captive portal.

Interception and the man-in-the-middle attack

A man-in-the-middle attack refers to any situation where an attacker inserts themselves between you and the service you’re using. On a network they don’t control, they can try to eavesdrop on your exchanges, inject content, or redirect you to a fake page to capture a login. Here again, HTTPS blocks a large share of these attempts, but not all: DNS lookups (which reveal the sites you visit), poorly configured apps, and connected devices remain exploitable weak spots on a rigged network.

If HTTPS already encrypts, is a VPN really useful?

Good question, and the answer is nuanced. HTTPS encrypts the content exchanged with a properly configured site. On that traffic, a VPN adds little extra protection. But it plugs the blind spots HTTPS leaves open:

• It hides your DNS lookups and every domain you contact, invisible to the network operator.
• It protects apps and connected devices that encrypt their traffic poorly, or not at all.
• On an evil twin hotspot, the attacker only captures an encrypted stream to the VPN server, not the details of your activity.
• It encrypts all of the device’s traffic at once, without depending on the quality of each individual app.

How a VPN encrypts and protects your connection

As soon as you turn it on, the VPN app establishes an encrypted tunnel between your device and a remote server. In practice, your data is wrapped in a layer of encryption (AES-256 or ChaCha20 depending on the protocol) before it even leaves your phone or laptop. On public Wi-Fi, the person snooping on the network, or the one running a fake hotspot, only sees an unreadable stream heading to the VPN server. There is no way to extract your passwords, your emails, or your work logins.

Two details make the difference on the move. First, the kill switch: if the tunnel drops (network change, outage), it instantly blocks all connections to prevent any leak in the clear. Second, auto-connect on untrusted networks: on iOS and Android, you can set the VPN to switch on by itself the moment you join an unknown Wi-Fi. That’s essential, because the window of risk sits precisely between the moment you join the network and the moment the VPN starts.

Smart habits on public Wi-Fi

The VPN is the centerpiece, but a few simple habits sharply reinforce your security when you’re out and about:

• Check the network name with a staff member before connecting, to rule out the evil twin.
• Disable auto-connect and file sharing while you’re traveling.
• Make your device forget the network once you leave, to avoid silent reconnections.
• Keep your system and apps up to date: many network attacks exploit flaws that are already patched.
• When in doubt, use your mobile hotspot (4G/5G), which is far harder to intercept than open Wi-Fi.
• Turn on a reputable VPN with a kill switch, ideally with auto-connect on untrusted networks.

On a network you don’t control, assume someone can watch, and encrypt everything.

What a VPN does NOT do on public Wi-Fi

The honesty section, and it matters. A VPN is an excellent network shield, but it has real limits:

• It does not make you anonymous. It hides your activity from the local network and your internet provider, but the VPN provider itself sees your traffic pass through. Hence the importance of a genuinely audited no-log policy.
• It does not replace antivirus or common sense: it won’t protect you if you download a booby-trapped file or enter your credentials on a fake page (phishing).
• A shady free VPN can be worse than nothing: you’d be handing all your traffic to an unknown company. On that front, trust in the provider is everything.
• It doesn’t protect you from risks tied to your own identification: logged into your accounts, you stay identifiable, VPN or not.