Is it safe to use public Wi-Fi with a VPN?

Yes, a VPN makes public Wi-Fi significantly safer. It encrypts all traffic leaving your device, preventing anyone on the network from reading your data. With a VPN active, MITM attacks, packet sniffing, and session hijacking become ineffective because the attacker only sees encrypted data. For maximum protection, enable the VPN before connecting to the public network and keep the kill switch active to prevent leaks if the VPN momentarily disconnects.

Can someone hack me through public Wi-Fi?

Yes, public Wi-Fi exposes you to several attack vectors. Without protection, attackers on the same network can intercept unencrypted traffic, capture login credentials, steal session cookies, and potentially push malware to your device. The risk is highest on open (no password) networks, but even password-protected public networks are vulnerable since all users share the same encryption key. Using a VPN, keeping your software updated, and following the protection steps above reduces your risk to near zero.

Should I use my phone's mobile data instead of public Wi-Fi?

If you don't have a VPN, using mobile data (4G/5G) is significantly safer than public Wi-Fi. Cellular connections are encrypted between your phone and the cell tower, and each user has an individual encrypted channel — unlike shared Wi-Fi. However, your mobile carrier can still see your browsing activity. The ideal solution is using any available network (including public Wi-Fi) with a VPN, which provides strong encryption regardless of the underlying connection type.

What should I avoid doing on public Wi-Fi without a VPN?

Without a VPN, avoid logging into email, banking, or any account with sensitive information. Don't enter credit card numbers, social security numbers, or other personal data. Avoid accessing work resources or corporate accounts. Don't download files or accept software update prompts. Don't access HTTP (non-HTTPS) websites. Essentially, if you wouldn't write it on a postcard for strangers to read, don't transmit it over unprotected public Wi-Fi.

Does airplane mode protect me from Wi-Fi attacks?

Airplane mode disables all wireless radios including Wi-Fi, so yes — if Wi-Fi is off, you can't be attacked over Wi-Fi. However, on most devices you can enable Wi-Fi while in airplane mode, which negates this protection while still blocking cellular. Airplane mode is not a practical security tool — it simply disconnects you from everything. A VPN is the better solution because it lets you stay connected securely.

Are hotel Wi-Fi networks safe?

Hotel Wi-Fi networks are public networks with the same risks as any other public Wi-Fi — they just feel safer because you're in a private room. The network itself is shared with every guest, staff member, and anyone who obtains the password. Some hotels use outdated network equipment with known vulnerabilities. Business travelers are specifically targeted because their devices often contain valuable corporate data. Always use a VPN on hotel Wi-Fi, and treat it with the same caution as any coffee shop or airport network.

Public Wi-Fi Security: How to Protect Yourself on Open Networks

Free Wi-Fi at coffee shops, airports, hotels, and libraries is convenient — and genuinely dangerous. Public networks are inherently insecure: they're shared with strangers, often lack encryption, and give attackers easy access to monitor or intercept your traffic. Industry surveys consistently find that roughly a quarter of public Wi-Fi hotspots use no encryption at all, and even encrypted public networks share the password with every connected user. This guide covers the real risks of public Wi-Fi, the specific attacks you're vulnerable to, and practical steps to protect yourself — including why a VPN is the single most effective defense.

Public Wi-Fi Risks

Man-in-the-Middle (MITM) Attacks

In a MITM attack, an attacker positions themselves between your device and the Wi-Fi access point, intercepting all traffic flowing between them. On an unencrypted network, they can read emails, capture login credentials, view financial transactions, and modify web content in real time. Even on HTTPS websites, sophisticated MITM attacks using tools like SSLstrip can downgrade connections. A VPN makes MITM attacks ineffective because all your traffic is encrypted before it leaves your device.

Evil Twin Attacks

An attacker creates a fake Wi-Fi hotspot with the same name as a legitimate one — "Starbucks_WiFi" or "Airport_Free" — and waits for devices to connect automatically. Once connected, all your traffic routes through the attacker's device, giving them complete visibility into everything you do online. Your phone may connect to evil twins automatically if you've previously connected to a network with the same name. These attacks are trivially easy to execute with tools available for free online.

Packet Sniffing

On open (unencrypted) Wi-Fi networks, anyone with freely available tools like Wireshark can capture and read all network traffic. This includes unencrypted HTTP requests, email content, FTP credentials, and DNS queries that reveal which websites you're visiting. While HTTPS protects the content of secure connections, packet sniffing still reveals metadata — which domains you visit, when, and how often. A VPN encrypts all packets, making sniffed data completely unreadable.

Session Hijacking (Sidejacking)

After you log in to a website, your browser stores a session cookie that keeps you authenticated. On public Wi-Fi, an attacker can capture this cookie through packet sniffing and use it to impersonate you — accessing your email, social media, or other accounts without needing your password. While HTTPS cookies are protected in transit, not all websites properly flag cookies as secure-only. Session hijacking is particularly effective on networks where an attacker has MITM positioning.

Malware Distribution

Attackers on the same public network can exploit vulnerabilities in file-sharing protocols, inject malicious content into unencrypted web pages, or send fake software update prompts. If your device has file sharing or AirDrop enabled, attackers can push malicious files directly. Some advanced attacks use compromised routers to inject JavaScript miners or redirect downloads to malware-laden versions. Keep your OS and apps updated, disable file sharing on public networks, and never accept unexpected file transfer requests.

How to Protect Yourself

Public Wi-Fi doesn't have to be dangerous if you take the right precautions. These six steps significantly reduce your risk on any open network:

Use a VPN — this is the most effective single step. A VPN encrypts all traffic leaving your device, making it unreadable to anyone on the network. Even if an attacker captures your packets, they see only encrypted data. Enable your VPN before connecting to the Wi-Fi network, and use the kill switch feature to block traffic if the VPN disconnects. Proton VPN and NordVPN both offer auto-connect options for untrusted networks.
Verify HTTPS on every website — look for the padlock icon in your browser's address bar. Never enter passwords, payment information, or personal data on HTTP (non-HTTPS) sites. Consider installing the HTTPS Everywhere extension or enabling your browser's HTTPS-only mode. HTTPS encrypts the connection between your browser and the website, but a VPN provides broader protection covering all applications.
Disable auto-connect to Wi-Fi networks in your device settings. This prevents your phone or laptop from automatically joining previously known network names — which could be evil twin networks. On iOS, go to Settings > Wi-Fi and disable Auto-Join for public networks. On Android, go to Settings > Network > Wi-Fi Preferences and disable auto-reconnect.
Forget public Wi-Fi networks after use. Your device remembers networks you've connected to and will reconnect automatically when in range. Go to your saved networks list and remove any public hotspot — coffee shops, airports, hotels. This prevents your device from connecting to networks you don't explicitly choose.
Enable your operating system's firewall and disable file sharing. On macOS, go to System Settings > Network > Firewall and enable it. On Windows, ensure Windows Defender Firewall is active. Disable AirDrop, Nearby Sharing, and any network discovery features when on public networks. These features are designed for trusted networks and create attack surfaces on public ones.
Enable two-factor authentication on all important accounts. Even if an attacker captures your password on public Wi-Fi, 2FA prevents them from accessing your account without the second factor. Use an authenticator app (Google Authenticator, Authy) rather than SMS. See our full 2FA guide for setup instructions.

Why a VPN Is Essential on Public Wi-Fi

A VPN is the single most effective tool for public Wi-Fi security. It encrypts all traffic between your device and the VPN server using AES-256 (or ChaCha20-Poly1305 with WireGuard) — the same algorithms protecting HTTPS and TLS 1.3, well above any plausible brute-force threat. This neutralizes MITM attacks, packet sniffing, and session hijacking in one step. Modern VPNs like Proton VPN and NordVPN include kill switches that block all internet traffic if the VPN connection drops — preventing even momentary exposure. Auto-connect features can activate your VPN whenever you join an untrusted network. For the best protection, choose a VPN with WireGuard support (fastest), an audited no-logs policy, and DNS leak protection.

Encrypts all traffic with AES-256 or ChaCha20, making data unreadable on shared networks
Kill switch blocks all traffic if VPN drops, preventing momentary exposure
Auto-connect activates VPN when joining untrusted networks
DNS leak protection ensures DNS queries stay inside the encrypted tunnel

Public Wi-Fi Myths

"HTTPS makes public Wi-Fi safe"

HTTPS encrypts the connection between your browser and a specific website, but it doesn't protect all your traffic. DNS queries often travel unencrypted, revealing which sites you visit. Other applications on your device may use unencrypted protocols. HTTPS doesn't prevent an attacker from seeing your connection metadata or from intercepting traffic from non-HTTPS services. A VPN provides comprehensive protection that HTTPS alone cannot match.

"Password-protected Wi-Fi is secure"

A Wi-Fi password prevents unauthorized people from joining the network, but everyone who has the password shares the same encryption key. On WPA2-Personal networks (the type used at most public venues), anyone with the password can decrypt other users' traffic. Even WPA3 networks, while improved, don't fully protect against other authenticated users on the same network. The password keeps outsiders out — it doesn't protect you from insiders.

"I have nothing worth stealing on public Wi-Fi"

You might not be entering credit card numbers, but public Wi-Fi attacks capture far more than financial data. Email credentials give attackers access to password resets for every linked account. Social media logins enable impersonation and social engineering. Session cookies allow access without passwords. Browsing history and DNS queries reveal personal interests, health concerns, and political views. Even seemingly harmless data becomes valuable when aggregated. Everyone has something worth protecting.

The Bottom Line

Public Wi-Fi is inherently insecure, but it doesn't have to be avoided — it just needs to be used wisely. A VPN is the single most important tool for public Wi-Fi security, encrypting all your traffic and neutralizing the most common attacks. Combine it with HTTPS awareness, disabled auto-connect, 2FA on important accounts, and basic network hygiene, and you can use any Wi-Fi network with confidence. The real danger isn't public Wi-Fi itself — it's using it without protection.

Public Wi-Fi Security: Protect Yourself on Open Networks