Home › Guides · Updated 21 October 2026

Public Wi-Fi: when a VPN helps and when it doesn't

The real risks of café, hotel and station Wi-Fi, what HTTPS already protects, where a VPN adds protection, the settings that matter (always-on, full-device, no split tunnelling) and safer alternatives such as mobile data.

Free Wi-Fi in cafés, hotels, trains and airports is convenient, and it is also a network shared with strangers that you don't control. Advice about it ranges from "never use it" to "a VPN makes you invisible". Neither is right. This guide explains what the risks really are today, what protection you already have, and where a VPN genuinely adds something.

What can go wrong on public Wi-Fi?

The NCSC's "Connecting Securely" exercise for organisations sets out the main risks of untrusted networks. In practical terms they are:

• Fake hotspots. Anyone can set up a network called "Free Station WiFi" or copy the name of the café's real network. If you join it, the person running it sits between you and the internet.
• Snooping on unencrypted traffic. Anything sent without encryption can be read by whoever controls or can watch the network.
• Attacks on your device. Other devices on the same network may try to connect directly to yours. The NCSC lists protecting devices from network attacks, such as ARP spoofing and attacks on open network interfaces, among the benefits of using a VPN.
• Flaws in Wi-Fi itself. Weaknesses are occasionally found in Wi-Fi protocols. The NCSC's guidance on the "KRACK" Wi-Fi vulnerability is one example; the fix there was to update devices.

What HTTPS already protects

Most websites now use HTTPS, shown by the padlock or "https://" in the address bar. HTTPS encrypts the connection between your browser and the website, using a certificate that proves the site's identity; Let's Encrypt explains how this works. On an HTTPS site, someone on the same Wi-Fi can generally see which site you're connecting to, but not the pages you read, the passwords you type or the card details you enter.

That is why online banking on café Wi-Fi is far less risky than it was. The weak points are elsewhere: websites or apps that still don't encrypt properly, warnings you click through, and login pages on fake hotspots designed to trick you into typing details.

Where a VPN adds protection

A VPN creates an encrypted tunnel from your device to the VPN provider's server, so everything leaves the public network already encrypted. The NCSC's VPN guidance is written for organisations, but the benefits it describes also apply to individuals on public Wi-Fi:

• Protecting data in transit across an untrusted network, including from apps that don't encrypt well;
• Preventing direct connections to and from the local network, which shields your device from some network attacks;
• Hiding which sites you visit from the hotspot operator and other users on the network.

The trade-off is that the VPN provider can now see that information instead, so you are moving trust from the café's network to the VPN company. That is often a sensible swap, but only with a provider you have good reason to trust. Our practical checklist for choosing a VPN covers what to look for.

The settings that make the difference

A VPN only protects traffic that actually goes through it. The NCSC's recommendations for organisations translate well to personal use:

• Connect automatically. The NCSC advises using a VPN that connects automatically, because a manual VPN leaves you exposed during any time it isn't switched on. Most apps have an "auto-connect on untrusted Wi-Fi" setting.
• Protect the whole device. The NCSC recommends a full-device VPN and warns that per-app VPNs increase the risk that some data is sent outside the tunnel.
• Avoid split tunnelling on public networks. The NCSC says enabling it increases the risk that data is exposed to the unprotected network.
• Use a kill switch if your app has one, so traffic stops rather than leaking if the VPN drops.
• Keep the app updated. The NCSC notes that third-party VPN software needs regular updates like any other software.

To check your VPN isn't leaking your real address through your browser, see our guide to WebRTC and IPv6 leaks.

The captive portal catch

Many hotspots make you accept terms on a sign-in page before you get internet access. A VPN that blocks all traffic until it connects can stop that page loading. The NCSC describes this exact issue with captive portals and says a built-in captive portal helper, as found on iPhones and Macs, is the less risky way to sign in. Sign in through the helper, then let the VPN connect, and don't type personal details into a hotspot's sign-in page beyond what's clearly needed.

What a VPN doesn't do

• It doesn't stop you typing your password into a phishing page. Passkeys, which the NCSC says resist phishing, help much more there.
• It doesn't remove malware or protect an out-of-date device.
• It doesn't make you anonymous to the sites you log in to.

Our guide to what a VPN can and cannot hide goes into these limits in more depth.

Safer alternatives

Often the simplest option is not to use the shared network at all. Using mobile data on your phone, or your phone's personal hotspot for a laptop, keeps you off the public Wi-Fi entirely. The NCSC's guidance also discusses tethering, noting that some phones route tethered devices' traffic outside the phone's VPN, so run the VPN on the laptop too if you rely on it.

Hotels, trains and planes: specific situations

Hotels. Hotel networks are shared by every guest, and some put all rooms on one flat network. Treat them like café Wi-Fi: VPN on, sharing off. If the room has a wired socket, it isn't automatically safer; it's still the hotel's network.

Trains and coaches. On-board Wi-Fi usually signs you in through a captive portal and may block or slow some VPN connections. If the VPN won't connect after signing in, use mobile data for anything sensitive rather than turning protection off.

Planes. In-flight Wi-Fi is typically paid, slow and portal-based. Use it for messaging and reading, and save banking for when you land.

Work devices. If your employer gives you a laptop with its own VPN, use that rather than adding a personal one on top, and follow your organisation's policy. The NCSC's guidance is written precisely for organisations configuring those connections.

A short routine for public Wi-Fi

1. Check the network name with staff, and be suspicious of open networks with generic names.
2. Set your device to treat the network as public, which turns off file and device sharing.
3. Let your VPN auto-connect, with full-device protection and a kill switch on.
4. Never click through browser certificate warnings.
5. For banking or anything sensitive, consider switching to mobile data.
6. When you leave, tell your device to "forget" the network so it doesn't rejoin a look-alike later.

Sources and further reading

• NCSC: Device security guidance: Virtual Private Networks
• NCSC: Connecting Securely micro exercise (PDF)
• NCSC: 'Krack' Wi-Fi guidance
• NCSC: Passkeys: what you need to know
• Let's Encrypt: How it works

Facts and links checked on 21 October 2026. Spotted an error? Tell us and we will correct it.