Do you need a VPN on public Wi-Fi? Usually not for everyday browsing, but it can help in a few situations. Most banking, email and shopping sites now encrypt your traffic with HTTPS, which covers much of what a VPN once did. The bigger travel risks are fake hotspots, sloppy sign-ins and out-of-date devices. This guide explains what official agencies say, when a VPN helps, what to use instead, and how to choose one if you decide to buy.
What official agencies say about public Wi-Fi
As of 8 November 2026, the official pages worth reading are a mix of newer and older material, so the dates matter.
HTTPS has reduced the risk
The US Federal Trade Commission (FTC) says a secure website encrypts your information even if the network does not. It advises looking for https on every page you visit, not only the login page. The UK National Cyber Security Centre (NCSC) makes a similar point in a 2017 page: services such as email, banking and shopping already encrypt data before it leaves your device.
The same FTC page warns that you should not assume a public network is encrypted, because most are not. It says you can only be sure a network uses effective encryption if it asks for a WPA or WPA2 password. Even then, a hotel password shared with every guest is not the same as a private network.
Fake hotspots (evil twins)
The US Cybersecurity and Infrastructure Security Agency (CISA) describes an “evil twin” attack. An attacker studies a real public access point, then sets up a rogue one that imitates it, often with a stronger signal. People who join it can have what they send read by the attacker. CISA advises confirming the network name and password before connecting, and using at least WPA2 encryption. It also advises turning off file sharing on public networks. Note that CISA marks that page as archived content that may be outdated.
Captive portals and VPNs
Many hotels and airports make you accept terms on a login page, called a captive portal. NCSC guidance for organizations notes that a VPN forced on at all times can clash with these pages, because the device must reach the portal first. In practice, you may need to connect to the Wi-Fi and finish the portal before switching your VPN on. That NCSC page is written for administrators and says it does not cover individual users’ reasons for using a VPN.
When a VPN helps and when it does not
A VPN encrypts the connection between your device and the VPN company’s server. That protects data in transit across an untrusted network, which the NCSC confirms. A 2018 CISA alert also says VPNs can help protect phone data on public Wi-Fi. But a VPN does not make you anonymous, stop phishing, or fix a device that is missing security updates.
| Situation | Does a VPN help? |
|---|---|
| Browsing HTTPS sites on hotel Wi-Fi | Small extra benefit; HTTPS already encrypts the content |
| Using an app or site that is not encrypted | Yes, it encrypts the hop to the VPN server |
| Worried the hotspot is a fake | Partly; better to confirm the network name with staff and avoid it if unsure |
| Logging in to work systems | Yes, if your employer requires or provides one |
| Phishing links or fake login pages | No; encryption does not stop you entering details on a scam site |
| Old phone or laptop without updates | No; update the device first |
The FTC page on public Wi-Fi does not mention VPNs, so the agency advice is more cautious than most VPN marketing. CISA, in an older guide on securing wireless networks, does not mention them either.
Alternatives to a VPN
- Phone hotspot. Tethering your laptop to your phone uses your mobile connection instead of a shared network, which avoids the fake-hotspot risk described above.
- Travel eSIM or local data. A data plan abroad lets you skip public Wi-Fi for sensitive tasks. See our guide, Is a Travel eSIM Worth It? How to Choose One for a Trip.
- Wait for a trusted network. If you can, save banking and other sensitive tasks for a network you trust. Our home Wi-Fi security guide covers the network you will return to.
Good habits that matter more than any app
- Ask staff for the exact network name and login steps. Do not join a similar-looking name.
- Check for https on every page, and log out when you finish. The FTC advises not staying permanently signed in.
- Use a different password for each site.
- Never email card, Social Security or bank account numbers, even on a secure network, as the FTC advises.
- Turn off file sharing on public networks, as CISA advises.
- Keep your phone and laptop updated before you leave. Travelers heading to the UK may also want to read Can Americans Use UK eGates? while planning the trip.
How to choose a travel VPN
If you still want one, research the app before you install it and check what it does with your data. Use this checklist.
- Read the no-logs policy and look for independent audits. A policy is only a promise. Look for a named auditor, the date, and what the audit covered, since an app audit is not the same as a no-logs audit.
- Check the protocols. WireGuard and OpenVPN are widely offered. The NCSC recommends IPsec for organizations, but consumer apps usually offer the first two.
- Look for a kill switch. Providers describe it as blocking your traffic if the VPN drops, so nothing leaks onto the hotel network.
- Consider jurisdiction. Providers state where they are based. Proton, for example, says it operates under Swiss privacy law. Treat this as one factor, not a guarantee.
- Count your devices. Plans differ. ExpressVPN says one subscription covers up to 14 simultaneous connections, but check the current limit before you buy.
- Avoid free VPNs that sell data. Check whether an app shares information with third parties. If you are not paying, find out how the company makes money.
- Check the refund policy. A money-back window lets you test the app on a real trip. Read the terms, including how long the window lasts.
- Test the app on captive portals. Make sure it works with hotel and airport login pages.
Examples of audit claims, in the companies’ own words
These are vendor claims, not endorsements. ExpressVPN says it undergoes regular third-party audits by firms including PwC, Cure53 and KPMG, and that its kill switch blocks traffic when the connection drops. Proton says its VPN apps are open source and independently audited, and that its kill switch cuts network traffic if the connection is lost. These claims have not been independently checked for this guide, and Proton’s page does not give audit dates. Read the audit reports themselves before you rely on them.
FAQ
Is hotel Wi-Fi safe without a VPN?
For ordinary HTTPS browsing, the risk is lower than it used to be. The FTC says a secure site encrypts your information even if the network does not. The main risks are joining a fake network and entering details on a scam site, which a VPN does not fully solve.
Is my phone’s mobile data safer than airport Wi-Fi?
Your own mobile connection is not shared with strangers the way hotel Wi-Fi is, so it avoids the fake-hotspot risk. If roaming costs are a worry, a travel eSIM is one option.
Do I need to turn the VPN off to use a hotel login page?
Sometimes. The NCSC notes that a device must reach the captive portal before a forced VPN can connect. Connect to the Wi-Fi, complete the portal, then turn your VPN on.
Bottom line
Most travelers do not need a VPN for routine browsing, because HTTPS does the heavy lifting. A VPN is a reasonable extra layer if you often use public Wi-Fi, handle work data, or use apps you cannot check. First verify the network name, keep devices updated, use unique passwords, and switch to your phone’s data for anything sensitive. If you buy a VPN, choose on audits, features and honest data practices rather than marketing claims.
Sources
- FTC: Are Public Wi-Fi Networks Safe? What You Need To Know
- NCSC: Virtual Private Networks (VPNs)
- NCSC: ‘Krack’ Wi-Fi guidance
- CISA: Securing Wireless Networks
- CISA: FTC Releases Article on Choosing VPN Apps for Mobile Phones
- Proton: VPN security explained
- ExpressVPN: Features
