The short answer
Public Wi-Fi is safer than it used to be, because most sites now use HTTPS. But the network can still see which sites you visit, fake hotspots are easy to set up, and some networks tamper with traffic. A VPN closes those gaps.
What the hotspot owner can see
Whoever runs the network, or anyone who has taken it over, can usually see:
- Which sites you visit, from the lookups your device makes and the names it sends when connecting.
- When and how much you use each one.
- Which devices are connected, and roughly what they are.
- Anything that isn't encrypted, such as the rare site or app that still doesn't use HTTPS.
With HTTPS, they can't read the pages or what you type. But the list of places you go says a lot on its own.
Fake hotspots
A laptop or a small device can broadcast a network called "Airport_Free_WiFi", or copy the name of the café's real network. Your phone may even join it automatically if it has seen that name before.
Once you're on it, the owner sees everything the real hotspot would, and can try to send you to look-alike pages or ask you to "sign in" with an account password.
Be suspicious of any Wi-Fi sign-in page that asks for the password to an account you already have, like email or social media.
Networks that tamper with traffic
Some hotspots add their own ads or tracking to pages, block apps they don't like, or answer your lookups with their own addresses. It's rarely malicious, but it's your traffic.
How a VPN changes the picture
With a VPN on, your phone builds an encrypted tunnel to the VPN server before anything else goes out. The hotspot, real or fake, sees one encrypted connection. It can't see the sites, change the pages or answer your lookups.
- Turn on auto-connect for untrusted networks so you're covered the moment you join.
- Use the Kill Switch so nothing leaks if the tunnel drops while you move around.
A checklist for public Wi-Fi
- Prefer networks you can verify, like the one printed on the receipt or at the front desk.
- Turn off auto-join for networks you don't use regularly.
- Complete the hotspot's sign-in page, then let your VPN connect.
- Don't type account passwords into Wi-Fi sign-in pages.
- Keep your phone updated, and use a VPN with a Kill Switch.
Key takeaways
- HTTPS protects the content of pages, not the list of sites you visit.
- Fake hotspots are cheap and easy, and your phone may join one automatically.
- A VPN encrypts everything between you and the VPN server, whatever the hotspot is.
- Auto-connect on untrusted Wi-Fi means you don't have to remember.