Public Wi-Fi and VPNs: What They Do and Do Not Protect

The free Wi-Fi at a cafe, airport or hotel is convenient, and it also raises a fair question: can other people see what I do on it? A few years ago the honest answer was often yes. Today it is more nuanced, and the nuance is where most of the confusion about VPNs begins.

This entry sorts out what risk public Wi-Fi still carries, what a virtual private network (VPN) does about it, and where a VPN gives no help at all. The aim is to replace both fear and false comfort with a clear picture, so you can decide when a VPN is worth using and when simple habits are enough.

What the risk used to be, and what it is now

On an open network, your device sends data through a router that many strangers share. In the early days of public hotspots, most websites did not encrypt their traffic. Anyone nearby with the right tools could read what passed through, including logins.

That has changed. The FTC states that because most websites now encrypt their traffic, connecting through a public Wi-Fi network is usually safe. The padlock icon or "https" in the address bar shows that the connection between your browser and the site is encrypted. If you want the mechanics, encryption basics explains how this works.

"Usually safe" is not "always safe". Some risks remain:

• Fake hotspots. Anyone can create a network with a name that looks like the cafe's. The name alone proves nothing.
• Unencrypted traffic. Some apps and older sites still send data in the open. The FTC notes that checking apps is harder than checking a browser, though most use encryption.
• Fake sites. Encryption protects data on its way. It does not protect you from a malicious site. Scammers can build fake sites that also use encryption.
• Your own device. Open sharing settings and out-of-date software are weak spots on any network.

What a VPN is and does

A virtual private network, or VPN, creates a connection between your device and a server run by the VPN provider. Your traffic travels through that connection to the server, and from there to the websites you visit.

Picture sending your mail through a trusted courier who puts it in a sealed bag at your door. People along the street cannot read it. The courier's depot opens the bag and posts the letters, so the depot sees them.

In a 2018 post, the FTC explains it in similar terms. A VPN app routes your traffic through servers the provider controls, and websites may see the provider's address instead of yours. Some VPN apps also encrypt the data between your device and the VPN server. On an open network, that means someone watching the Wi-Fi sees only scrambled data, even when a site does not encrypt its own traffic.

Who sees what

The last row is the important one. A VPN does not remove the need for trust. It moves it from the Wi-Fi owner and your internet provider to the VPN company.

What a VPN does not do

Clear limits keep expectations realistic. According to the FTC, a VPN app generally will not make you entirely anonymous. Beyond that:

• It does not make a fake site real. A phishing page works the same through a VPN. Review the phishing checks either way.
• It does not remove malware or fix a weak device. It protects the connection, not the device at either end.
• It does not stop a site from knowing who you are once you sign in or share an email address.
• It does not guarantee encryption. The FTC warns that some VPN apps encrypt only part of the traffic, or none of it.
• It does not protect an account with a weak password. Passwords and second sign-in steps remain your main defenses.

Do you need one?

It depends on what you are trying to do. Use this as a rough guide:

How to judge a VPN provider

This entry does not rank products. The FTC suggests general checks before you install any VPN app:

1. Read independent reviews from sources you trust, and look up the developer.
2. Look at the permissions the app requests and ask whether they fit its purpose.
3. Look for reliable information on whether and how it encrypts your traffic.
4. Read the privacy policy to see whether it shares data with third parties such as advertisers.

The FTC adds that free apps often depend on advertising or third-party data sharing. If you give an app permission to carry all your traffic, you are trusting it with a lot.

Habits that work on any network

These matter more than any single tool:

1. Confirm the network name with staff before joining. Do not join a similar-looking name.
2. Look for https and the padlock before entering a password or card number.
3. Keep your device updated. The updates entry explains why.
4. Use strong, unique passwords and two-factor authentication, so a stolen login alone does not open the account. The FTC recommends both.
5. Turn off automatic joining of open networks, and turn off file or device sharing on public networks.
6. Log out when you finish, especially on shared computers.
7. Use your phone's mobile connection for sensitive tasks if you are unsure about the Wi-Fi.

Common mistakes

• Believing a VPN makes you anonymous. It changes who can see your traffic, not who you are once you log in.
• Picking a VPN because it is free or popular. The provider can see your traffic, so research it first.
• Joining the first network with a familiar name. A hotspot name can be copied.
• Ignoring browser warnings. If the browser warns about a certificate or a site, stop.
• Assuming the padlock means the site is trustworthy. It means the connection is encrypted.
• Skipping device updates because a VPN is on. A VPN does not patch software flaws.

FAQ

Is public Wi-Fi safe?

The FTC says it is usually safe because most sites encrypt traffic. Take sensible steps anyway, such as using https, keeping software current and avoiding unknown networks.

Does a VPN hide my IP address?

It hides your network's address from the sites you visit, which see the VPN server's address instead. The VPN provider still sees where the traffic comes from.

Is using a VPN legal?

Rules differ by country and by purpose, and this entry does not give legal advice. Check the rules where you live and, for work, your employer's policy.

Should I use my phone's hotspot instead?

It is a reasonable alternative, because you control the network. Set a strong hotspot password.

Where do I learn more?

Browse the Security Basics area, which covers passwords, updates and backups in the same plain style.