Public Wi-Fi advice has not caught up with how the web actually works now. Most of what you will read online describes threats that were largely solved a decade ago, while missing the ones that still apply.
What changed
Nearly all web traffic is now encrypted in transit by default. When you see a padlock, the contents of that connection cannot be read by someone else on the same network, whether that is the cafe’s router or a stranger with a laptop. The classic image of someone in the corner reading your passwords out of the air is, for ordinary browsing, largely obsolete.
That is genuinely good news, and it means you can stop worrying about the wrong thing.
What still applies
Everyone can see where you go
Encryption hides the contents, not the destination. The network operator can still see which sites and services you connect to, roughly when, and how much data you moved. On a hotel or airport network this metadata is often logged, and sometimes sold.
DNS is frequently unencrypted
Unless you have specifically enabled encrypted DNS, the lookups your device performs travel in the clear and are trivially readable, and are sometimes redirected.
Rogue access points
Anyone can name a network anything. A hotspot called “Airport_Free_WiFi” is not necessarily the airport’s. Once you connect, the operator controls your DNS and can attempt to intercept anything not properly secured.
Captive portals encourage bad habits
The sign-in page that hijacks your browser is, by design, indistinguishable from a phishing page. It has trained a generation of travellers to accept certificate warnings and type details into whatever appears.
Older and lazier apps
Browsers are strict about encryption. Some apps and smart devices are not, and still send data in ways they should not.
What a VPN does and does not fix
It fixes: the metadata problem, because the network operator now sees a single encrypted tunnel to one address rather than your destinations. It fixes unencrypted DNS, because lookups go through the tunnel. It substantially reduces the rogue access point risk, because the operator cannot usefully interfere with traffic inside the tunnel.
It does not fix: anything after the tunnel ends. A VPN does not stop you entering your password into a phishing page, does not remove malware, and does not make you anonymous to a service you have logged into. If you sign into an account, that service knows who you are regardless.
Practical habits
- Turn off automatic joining for open networks. It is the single highest-value setting on this list.
- Connect the VPN before you use anything, not after.
- Treat captive portals with suspicion. Never accept a certificate warning to reach one.
- Keep the device updated. Most real-world compromises use known, patched flaws.
- Use a passkey or an authenticator app where offered.
The honest summary: public Wi-Fi is much safer than it was, the remaining risks are mostly about who can see where you go rather than what you say, and that is precisely the part a VPN addresses.