VPN for Public Wi-Fi: Hotel and Airport Risks Explained

Is public Wi-Fi actually dangerous in 2026?

Two government sources give different answers, and reading them together is the most useful thing a traveller can do.

The FTC is describing the typical case: most sites encrypt traffic, so a stranger on the same network sees little. The BSI is describing the worst case: a network you cannot vouch for, used for something you cannot afford to lose. On a trip you meet both, often on the same day.

What is an evil twin hotspot?

An evil twin is a Wi-Fi network set up to look like a legitimate one: the same or a similar name as the hotel, airport lounge or café network. Phones that have joined a network with that name before may join it automatically. Whoever runs it sits between you and the internet, so they can see which services you connect to and can send you to look-alike login pages.

HTTPS still protects the content of properly encrypted sites, but it does not help if you type your password into a fake page. This is the FTC’s own warning: scammers create fake websites and encrypt them to make you think they are safe.

What helps:

• Ask staff for the exact network name and ignore look-alikes with small differences.
• Turn off auto-join for public networks, and forget hotel networks when you check out.
• Connect a VPN straight after joining, so traffic is encrypted before it crosses the network.
• Type addresses for banking and email yourself or use the official app, rather than following a link.

Why hotel captive portals break your VPN

Most hotel and airport networks start with a captive portal: a page where you accept the terms, enter a room number or watch an ad before the network lets other traffic through. Two things follow from that.

First, the portal step happens before any VPN can connect, so the page you fill in travels over the local network. Enter only what the hotel asks for (a room number, a surname), never a password you use elsewhere.

Second, a VPN that is set to connect automatically, especially with a kill switch on, can hide the portal page, so the network looks broken. The fix is simple: disconnect the VPN, open any plain web page so the portal appears, complete it, then reconnect the VPN before you open email, banking or anything else.

What HTTPS protects, and what it does not

The honest conclusion: a VPN moves trust from the hotel network to your VPN provider, which is why an audited no-logs policy matters. NordVPN’s no-logs policy has passed six independent reviews, first by PwC and then by Deloitte, the latest in 2025. For phishing, the paid NordVPN tiers include what it now calls next-gen antivirus, which it says warns you about scam websites and blocks trackers. Our best travel VPN comparison lists the audits for NordVPN, Surfshark, ExpressVPN and Proton VPN.

Public Wi-Fi checklist for your trip

1. Before you leave: install the VPN on every device, sign in, connect once at home, and turn on the kill switch.
2. On arrival: ask for the exact network name, join it, complete the captive portal, then connect the VPN.
3. For banking and work email: use the VPN, as the BSI advises, or switch to your own mobile data or an eSIM.
4. Every time: check for HTTPS, keep two-factor login and automatic updates on (FTC advice).
5. When you are done: switch Wi-Fi off when you do not need it (BSI advice), and forget the network at checkout.

If card security is part of the worry, our guide to Revolut fees abroad covers paying safely and cheaply on the road. For the wider question of whether a VPN is worth it at all, read do I need a VPN when traveling. Other reasons travellers use one are covered in our guides to streaming abroad and VPN rules by country.

Frequently asked questions

Is public Wi-Fi safe to use in 2026?

For everyday browsing, mostly yes. The US Federal Trade Commission says connecting through a public Wi-Fi network is usually safe because of the widespread use of encryption. Germany’s cyber security office, the BSI, adds a limit: do not open confidential data over a foreign Wi-Fi network, and if you have to, do it only through a VPN.

What is an evil twin hotspot?

A Wi-Fi network set up to look like a legitimate one, for example a copy of the hotel or airport network name, so that devices join it instead. Whoever runs it controls the connection: they can see which services you reach and can send you to look-alike login pages. A VPN encrypts traffic before it crosses that network, and checking the exact network name with staff helps you avoid it.

Does HTTPS make a VPN unnecessary on hotel Wi-Fi?

Not entirely. HTTPS encrypts the content of a page, which is why the FTC rates public Wi-Fi as usually safe. It does not stop the network operator seeing which sites and services you connect to, it does not protect apps that handle encryption badly, and the FTC itself warns that scammers encrypt fake websites to make them look safe.

Why does my VPN not connect on hotel Wi-Fi?

Usually because of the captive portal, the page where you accept terms or enter a room number. Until you complete it the network blocks other traffic, including the VPN, and a kill switch can hide the portal page. Disconnect the VPN, finish the login in the portal, then reconnect before you open anything else.

What if I cannot use a VPN on public Wi-Fi?

Use your own mobile data or an eSIM for banking and email, keep Wi-Fi switched off when you do not need it (a BSI tip), check that sites load over HTTPS, and turn on two-factor login and automatic updates as the FTC recommends. Leave sensitive tasks until you are on a network you trust.

The short version

Public Wi-Fi is fine for maps and reading the news. For banking, work email or anything you cannot afford to lose, follow the BSI: use a VPN, or use your own mobile data. Set the VPN up at home, learn the captive portal routine, and confirm the network name before you join.