What Public Wi-Fi Risks Actually Exist
Public Wi-Fi networks in airports, hotel lobbies, and cafes are shared by strangers. Without encryption between your device and the router, anyone on the same network can use free tools to capture data packets. This is called packet sniffing. If the websites you visit use only HTTP, or if an app sends data without encryption, a snooper can read your messages, passwords, and session cookies.
A more targeted risk is the evil twin attack, where a hacker sets up a Wi-Fi network with a name similar to the hotel’s or airport’s official one, tricking you into connecting. Once connected, the hacker can intercept all your traffic. Man-in-the-middle attacks can also happen on legitimate networks if the hacker is also on that network and uses spoofing to intercept your connection to a site.
These risks are real, but they are not inevitable. Modern websites and apps increasingly use HTTPS, which encrypts the connection between your browser and the website. Even on an open Wi-Fi network, your login to a bank or email provider with HTTPS is encrypted. However, the first request before the secure connection is established - including the domain name - can still be visible to someone on the same network.
Public Wi-Fi also poses offline risks: if you leave your device unattended or connect to a network you trust without verifying its name, you open the door to data theft. The riskiest locations are those with many travellers and few security checks, such as transit hubs and free public hotspots in tourist areas.
What a VPN Encrypts and What It Does Not
A VPN creates an encrypted tunnel between your device and the VPN server. Everything you send through that tunnel - website addresses, passwords, messages, file downloads - is scrambled so that anyone on the same Wi-Fi network cannot read it. This includes people running a packet sniffer or operating an evil twin network. The only thing visible on the local network is that your device is talking to the VPN server’s IP address. The content and destination are hidden from the network operator and other users.
However, this protection has limits. The VPN encrypts only the part of the journey between your device and the VPN server. Once your traffic leaves the VPN server and travels to the final website, it is no longer encrypted by the VPN. The website may use HTTPS, which is a separate encryption layer. The VPN operator can see which websites you visit and how much data you send, though not the content of HTTPS pages. A no-logs policy is a promise, not a technical guarantee, that the operator does not keep records.
A VPN also does not protect you from threats that happen before the tunnel starts. If your device is infected with malware, the VPN will not clean it. If you enter your password on a fake banking page, the VPN will encrypt that mistake but the scammer still receives your credentials. Similarly, a VPN cannot stop a website from tracking you through cookies or browser fingerprinting, and it does not replace a strong, unique password for each account.
Which Risks a VPN Cannot Solve for Travellers
Many travellers assume a VPN is a digital shield against all online threats. It is not. Here are specific risks that remain even when the VPN is on:
- Phishing and fake websites. A VPN encrypts your connection to a website but does not verify that the website is legitimate. If you click a link in a scam email and land on a copy of your airline login page, the VPN still sends your password directly to the scammer.
- Malware and device security. Downloading a file from an untrustworthy source can infect your device. A VPN does not scan files or block malicious downloads. Keeping your device’s operating system and apps updated is the only reliable defence.
- Weak account passwords. If your email or bank password is short, reused, or leaked elsewhere, a VPN does not make it stronger. Using a password manager and enabling two-factor authentication is essential.
- Data collection by the VPN provider. When you use a VPN, you are trusting the provider with your traffic. If the provider keeps logs or is compromised, your data may be exposed. No no-logs policy can be independently verified in real time.
- Local laws and content blocks. A VPN may help you access content from another country, but it does not guarantee that doing so complies with local laws or the terms of service of the streaming platform. Laws and enforcement change, and it is your responsibility to check current advice.
Practical Steps for Safer Public Wi-Fi Use
Use a VPN on public Wi-Fi to encrypt your traffic. Turn it on before you connect to the network, not after. Even with HTTPS, the VPN hides the domain names of the sites you visit from the local network operator, which is a privacy benefit.
Before connecting, verify the exact name of the network with hotel staff or the cafe. Avoid networks that ask for personal information or seem to require a login page that looks unfamiliar. If you are unsure, use your mobile data or an eSIM instead of public Wi-Fi. Cellular connections are generally more secure because they are encrypted between your device and the tower, though they are not immune to all risks.
Keep your device’s software updated. Install updates before your trip and enable automatic updates if possible. Use a firewall, disable file sharing, and turn off Wi-Fi when not in use. For sensitive tasks like banking or accessing work systems, consider using a mobile data connection rather than public Wi-Fi, even with a VPN.
Remember that a VPN is one tool in a broader security routine. Pair it with a password manager, two-factor authentication, and cautious behaviour online. No single product makes you invisible or immune to all threats. Staying informed about evolving risks and adjusting your practices accordingly is the most reliable approach for any traveller.
