Public Wifi and When to Use a VPN

"Never use public Wi-Fi" is advice from an earlier era. The web is encrypted almost everywhere now, which has quietly fixed most of the old dangers. But "mostly safe" isn't "always safe," and there's a lot of confusion — especially around VPNs. Here's the honest version.

What changed — and what didn't

Nearly every serious website now uses HTTPS, meaning the data between you and the site is encrypted even on an open network. The classic image of a stranger at the coffee shop reading your passwords out of the air is largely obsolete for normal browsing. That's the good news.

The risks that remain are more specific:

• Fake hotspots. Anyone can name a network "Airport Free WiFi." Connect to a look-alike run by an attacker and your traffic flows through their equipment.
• Unencrypted or misconfigured sites. The occasional site or app still doesn't encrypt properly, leaking whatever you send over it.
• Shoulder surfing. Low-tech but real — someone simply watching your screen or your typing.

What a VPN actually does

A VPN (virtual private network) encrypts all your device's traffic and routes it through the provider's server, so the local network — and a fake hotspot — can't see where you're going or inject anything. On untrusted Wi-Fi, that's genuinely useful.

Be clear on what it does not do, because the marketing oversells it. A VPN does not make you anonymous, doesn't stop phishing or malware, and doesn't protect an account with a weak password. You're also shifting your trust from the coffee-shop network to the VPN company — so the provider's honesty matters. Choose a reputable, independently audited, no-logs provider; a free VPN often pays for itself by selling your data. Compare trustworthy options on the VPN guide and reviews.

Simple habits for public networks

• Confirm the real network name with staff before connecting, to avoid look-alikes.
• Use cellular for sensitive tasks. Your mobile data connection is private by default — an easy alternative to any Wi-Fi.
• Turn off auto-connect so your device doesn't silently join open networks it doesn't recognize.
• Keep 2FA on so that even in the rare case a password is exposed, it isn't enough on its own.

At home, the network is yours to secure directly — that's covered in securing your home network.

Do you actually need a VPN?

VPNs are marketed as essential armor for everyone, which oversimplifies things. Whether one is worth it depends on what you're trying to accomplish.

• Regularly on untrusted networks? If you often work from cafés, hotels, or airports, a reputable VPN is a reasonable, low-cost layer — though using cellular data for sensitive tasks achieves much of the same protection for free.
• Mostly at home on your own network? The security case is weaker, since you already control and trust the connection. Securing your home network does more for you.
• Want privacy from your internet provider? A VPN does hide your browsing from the network you're on, but you're trusting the VPN company with that same visibility instead — only an improvement if they're genuinely trustworthy.

If you do choose one

Treat the provider like any company you're handing your data to. Favor ones with a clear, independently audited no-logs policy, a track record, and a transparent owner. Be especially wary of free VPNs: running a VPN network costs real money, and when you're not paying, your browsing data is often the product being sold — the opposite of what you wanted. A modest paid subscription from a reputable provider is the safer bet. Above all, remember a VPN is one narrow tool, not a substitute for strong passwords, 2FA, and updates — it protects the network path, and nothing more.

The bottom line is refreshingly undramatic: public Wi-Fi is fine for ordinary browsing thanks to widespread encryption, and for the occasional sensitive task you have two easy fallbacks — a reputable VPN or your own cellular data. Decide which you'll use before you travel, and you never have to weigh it up in the moment.

And keep perspective on where the real risk lives. Strong passwords, 2FA, and updates matter far more to your safety than which network you happen to be on, so keep your energy there rather than fearing the coffee-shop connection.