Public Wi-Fi and VPNs
Is coffee-shop Wi-Fi really dangerous in 2026? The honest risks, the evil twin trick, when a VPN helps and when it does not, and how to choose one.
The honest picture
Ten years ago, public Wi-Fi was genuinely risky because many websites did not encrypt traffic. Today nearly all major websites and apps use HTTPS encryption, so someone on the same café network generally cannot read your passwords or messages. Public Wi-Fi is less dangerous than its reputation, but some real risks remain.
The real risks
- Evil twin hotspots: an attacker creates a network named like the real one (
Airport_Free_WiFi) and runs a fake login page that asks for your email password or card details. - Captive portal phishing: a fake "sign in to use Wi-Fi" page that asks for a social media or email login.
- Unencrypted apps and old devices: some older apps and smart devices still send data without encryption.
- Network visibility: the network owner can see which domains you visit, even if not the contents.
- File sharing: a laptop set to share files on a "private" network may expose folders to other users.
Safe habits on public networks
- Pick the right network. Ask staff for the exact network name; avoid look-alikes and open networks with generic names.
- Mark it as Public on Windows (Settings > Network) so sharing and discovery are switched off. Macs and phones handle this automatically.
- Never give an email, social media or banking password to a Wi-Fi login page. Legitimate portals ask at most for a room number, a code, or to accept terms.
- Turn off auto-join for public networks you do not use regularly.
- Use your phone's hotspot for sensitive tasks if you have mobile data. Cellular data is generally safer than unknown Wi-Fi.
- Keep devices updated so known Wi-Fi and network flaws are patched.
What a VPN does
A VPN (virtual private network) creates an encrypted tunnel from your device to the VPN provider's server, and your traffic goes out to the internet from there.
| A VPN does | A VPN does not |
|---|---|
| Hide your traffic from the local network (café, hotel, airport) | Make you anonymous |
| Hide the sites you visit from your internet provider | Stop phishing, malware or scams |
| Change your apparent location | Protect accounts with weak or reused passwords |
| Add protection on untrusted networks | Make an unsafe website safe |
Using a VPN shifts trust from your internet provider or the café to the VPN company, which can see the same information. That makes choosing a trustworthy provider important.
Choosing a VPN
- Avoid unknown free VPNs. Running servers is expensive; free services may make money by collecting and selling data or showing ads, and some have been found to contain malware.
- Look for a published, independently audited no-logs policy, modern protocols (WireGuard or IKEv2/IPsec), and a kill switch.
- Some reputable services offer a limited free tier (for example Proton VPN). Many security suites and some routers include a VPN.
- Work devices usually come with a company VPN; use it as instructed.
For most people the best protection on public Wi-Fi is not a VPN but the basics: up-to-date devices, a password manager that refuses to fill on fake sites, and two-factor authentication.
