VPNs on Public Wi-Fi: What They Protect and How to Stay Safe Without One

What the owner of a public Wi-Fi network sees, even with HTTPS

Fifteen years ago, anyone on an open network could intercept your email or social media login because many sites only encrypted the password page. Everything else was sent in plain text. Today, Google reports that HTTPS handles 95% to 99% of page loads in Chrome across most platforms (Google blog). The network owner cannot read the contents of these pages, your passwords, or your credit card numbers.

But they can still see a few things.

• Which sites you visit. Before loading a page, your phone asks the network's DNS server for the site's IP address. This request is usually in plain text. Additionally, the website's name is typically sent unencrypted at the very start of the HTTPS connection.
• When and how much. Connection times and traffic volumes are always visible. It's easy to tell, for instance, if you spent an hour streaming a video.
• Your device. The network sees your hardware (MAC) address. Modern iPhones and Androids use a random address for each network by default, but it's best to verify this feature is on.
• Who you are. In Russia, you usually log into public networks using a phone number or Gosuslugi (the state public services portal). Local telecom regulations require operators to identify users and their devices at public access points (Government Decree No. 2607, paragraph 21). Because of this, your connection history on these networks is tied directly to you.

Websites without HTTPS and apps that fail to properly check security certificates still exist, mostly among older or smaller services. The network sees all their traffic.

A password on a café wall doesn't make a network secure

A password-protected network feels safer than an open one. It keeps random passersby out, but it doesn't protect you from other patrons. Under the common WPA2-Personal standard, encryption keys for each connection are derived from the shared password. Anyone who knows the password and captures the moment you connect can technically decrypt your traffic. If the password is on a chalkboard by the register, every customer knows it.

The newer WPA3 standard fixes this issue: every device gets unique encryption, even with a shared password. However, many routers still use WPA2, and you don't get to choose the café's network settings. Treat a network with a public password exactly like an open network.

Cafés, hotels, airports, and public transit: how public networks differ

The basic rules are the same, but every location has its quirks.

On public transit, your VPN app might sometimes fail to reconnect fast enough and show an error. Usually, just waiting a minute or switching to mobile data is enough. You don't need to fix anything.

Fake hotspots: the biggest risk in cafés and airports

An attacker doesn't need to hack the café's network. They just set up their own hotspot nearby with a similar or identical name. If your phone previously connected to an open network with that name, it might connect to the fake one automatically. This is known as an "evil twin" attack.

Next comes the fake login page. It looks like a standard Wi-Fi captive portal, but it asks you to log in with your email or social media account and steals your password. HTTPS won't save you here: you are handing over your data directly to the attacker.

These attacks lead to real arrests. In June 2024, the Australian Federal Police charged a man who allegedly set up fake free Wi-Fi networks at airports in Perth, Melbourne, and Adelaide, as well as on domestic flights. Users who connected were sent to a fake login page asking for their email or social media credentials. The investigation started after airline staff noticed a suspicious network mid-flight (AFP).

You shouldn't have to enter any personal details—such as logging in through an email or social media account—to connect to a free Wi-Fi network.

Detective Inspector Andrea Coleman, Australian Federal Police, June 2024

In Russia, this rule has a caveat. Entering a phone number, an SMS code, or logging in via Gosuslugi is standard for public Wi-Fi. However, a Wi-Fi login page will never need your email, social media, or banking passwords. If a portal offers a Gosuslugi login, check the URL: it must be on gosuslugi.ru, not a lookalike domain.

How to spot a fake network

• There are two networks with identical or very similar names, but staff only know of one.
• The network is fully open, even though the location usually requires a password or phone number.
• The login page asks for your email, social media password, credit card details, or prompts you to download an app.
• The login page URL looks suspicious, and your browser warns you about an insecure connection.
• The internet works immediately without a login page in a place that usually has one.

If you notice any of these red flags, disconnect, forget the network, and use mobile data. If you already entered a password, change it immediately and enable two-factor authentication.

How a VPN changes things on a public network

When your VPN is on, your device sends all its traffic fully encrypted to the VPN server. The Wi-Fi owner only sees a single connection to one server and the total amount of data transferred. With proper configuration, DNS requests also travel inside this encrypted tunnel, completely hiding your browsing history from the network. It also secures the gaps HTTPS leaves behind, like older unencrypted sites and apps with sloppy certificate checks. We explain how this works in detail in our guide on what a VPN is in simple terms.

However, a VPN doesn't verify where you type your passwords. If you connect to an evil twin hotspot and enter your details on its fake login page before turning on the VPN, the encrypted tunnel won't save you. A VPN is also useless against phishing links in emails: the fake bank website will just receive your password through an encrypted channel.

For this protection to work, your VPN actually needs to route all traffic through the tunnel. You can verify this, including checking for DNS leaks, in just a few minutes using our guide on how to test your VPN.

Connecting in hotels and airports: captive portal first, then VPN

Networks in hotels, airports, trains, and subways often greet you with a captive portal—a page asking you to enter your room number, verify your phone, or accept the terms of service. You don't have internet access until you pass it, meaning your VPN can't connect. Worse, having your VPN on or using a strict kill switch can prevent the captive portal from loading in the first place.

Here is why: the network intercepts your device's first web request and serves the captive portal instead. If that request is forced into an encrypted VPN tunnel, the network can't intercept it. The login page never appears, and the VPN fails to connect because there is no internet yet.

1. Ask a staff member for the exact network name. If you see two similar networks, confirm which one is real.
2. Connect to the network with your VPN turned off.
3. Wait for your device to open the login page automatically. If it doesn't, open a browser and try visiting any website—the network should redirect you.
4. Complete the login by providing only what the network actually needs: a phone number, SMS code, or room number.
5. Immediately turn your VPN on and wait for it to connect. Only then should you open your email, banking app, or work services.
6. If the VPN disconnects a few hours later, check if the network is asking you to log in again. Many guest networks have time-limited sessions.

Sometimes a VPN still won't connect even after you log in. Certain guest networks only allow basic web traffic. We cover common causes and solutions in our VPN won't connect guide.

Habits that keep you safe without a VPN

• Disable auto-connect for open networks. On an iPhone, tap the "i" icon next to the network in your Wi-Fi list and turn off "Auto-Join", then tap "Forget This Network" when you leave. Android has similar options in the network details.
• Make sure private Wi-Fi addresses are enabled. On an iPhone, toggle on "Private Wi-Fi Address" in the network settings. On Android, look for randomized MAC address settings in the same place.
• Set the network to public on Windows 11 laptops: go to Settings → Network & internet → Wi-Fi → network properties, and select "Public network". This hides your laptop from other devices on the network.
• Restrict AirDrop on iPhones: Settings → General → AirDrop → "Contacts Only". You don't want strangers sending you files in a crowded waiting room.
• Never ignore browser certificate warnings. If your browser says the connection to your bank or email is insecure, close the tab. This is exactly what a network interception attack looks like.
• Do not install profiles, certificates, or apps requested by a captive portal. A standard guest network never needs you to do this.
• Use mobile data for banking and payments if possible. Faking a cellular network is significantly harder than spoofing café Wi-Fi.
• Turn off Wi-Fi when you don't need it, like when traveling. This stops your phone from connecting to random networks and saves battery life.
• Keep your OS and browser updated. Updates patch vulnerabilities that attackers on the same network could exploit.
• Enable encrypted DNS. Android 9 and newer versions have a "Private DNS" setting (the easiest way to find it is to search for "DNS" in Settings). It hides your DNS requests from the network, but it doesn't hide the website name at the start of the connection, so it doesn't replace a VPN.

What to do if you don't have a working VPN

Using public Wi-Fi without a VPN is fine for reading the news, checking maps, watching videos, and messaging. For banking, payments, and work emails, it's better to wait for mobile data or tether from your phone to your laptop. To set up a hotspot, go to Settings → Personal Hotspot on an iPhone. On Android, go to network settings and find "Hotspot & tethering" (on Samsung: Connections → Mobile Hotspot and Tethering). Set a strong password for your hotspot, as people nearby might try to connect.

If you always need a VPN, install and test it at home beforehand. Trying to configure a client at the airport, where you only get internet after navigating a captive portal, is a hassle. We have step-by-step setup guides for iPhone and Android.

Stay away from unknown free VPN apps. On an untrusted network, they just introduce another middleman you know nothing about. We explain the risks in our article on free VPNs.