Advertising disclosure: This article has no affiliate links. As of 13 November 2026, Honest VPN Guide is not part of any affiliate program. Full details: Advertising and Affiliate Disclosure.
Public Wi‑Fi gets blamed for everything from stolen passwords to “hackers sitting two tables over.” Some of that risk is real. A lot of the marketing is theater.
This guide is the plain version: what changes when a VPN is off versus on on the same café, airport, or hotel network — and what a VPN never fixed in the first place. We have not published a paired off/on log for this page, and we will not invent one to sound technical.
What “public Wi‑Fi” actually exposes (and what it usually doesn’t)
“Public Wi‑Fi” usually means a shared network: many devices, one gateway, often a captive portal, sometimes weak or no isolation between clients. The operator (café, hotel, airport authority, or their ISP) can see connection metadata. Other clients on the same network might see local traffic that is not encrypted end-to-end, depending on how the network is built.
What that typically means in practice:
- Your IP on that network is shared or assigned by the venue. Sites you visit see some exit IP — often the venue’s, not your home ISP’s.
- DNS queries may go to the venue’s resolver unless your device or a VPN overrides them. That is useful for the operator; it is not automatically “someone reading your bank password.”
- HTTPS (the padlock) still encrypts the content of most modern web sessions between your browser and the site. A stranger on the same Wi‑Fi does not get a free plaintext copy of your Gmail body just because you joined a network called
Airport_Free. - HTTP (less common now, but still used for some captive portals, old device pages, or misconfigured links) can still leak. A VPN tunnels that path; it does not magically modernize every app.
What public Wi‑Fi usually does not mean:
- That every network is “compromised” by default. Absolutism without evidence is marketing, not a test. We will only make venue-specific claims for networks we actually used and logged.
- That HTTPS is useless without a VPN. HTTPS and a VPN solve different problems.
- That a VPN erases cookies, login sessions, or the fact that you signed into a site on that laptop last week.
The Electronic Frontier Foundation puts it plainly: a VPN is not a tool for anonymity. It can protect your location from some companies, but companies can still track you in other ways, including GPS, web cookies, tracking pixels or fingerprinting (Choosing the VPN That’s Right for You, last reviewed 28 July 2026, checked 13 November 2026). Privacy Guides adds that a VPN will not keep your browsing habits anonymous, and it will not add security to unencrypted HTTP traffic — use HTTPS as well (VPN Services, checked 13 November 2026).
Threat models differ. A journalist on a hostile network is not the same reader as someone checking email at a hotel breakfast. This page aims at the second group without pretending the first does not exist.
Side-by-side: same session with VPN off vs on
Until a real paired session exists, treat the tables below as the shape of the comparison — not results. Method: same device, same Wi‑Fi, VPN off then on, same hour, with the protocol and client version recorded.
IP / location / ISP visibility
| Check | VPN off (typical) | VPN on (typical intent) | Our log |
|---|---|---|---|
| Public IP a website sees | Venue / ISP path IP | VPN exit IP in chosen region | Not logged yet |
| Coarse geolocation guess | Near the venue | Near the VPN exit (often) | Not logged yet |
| ASN / ISP label on IP-check pages | Venue upstream | VPN provider’s or its hosting provider’s ASN | Not logged yet |
A VPN changes where your traffic leaves for the open internet and which exit IP sites see. It does not make you anonymous to the site after you log in. Account cookies still identify you.
DNS / WebRTC / IPv6 leak checks
| Check | What “pass” means | Our paired result |
|---|---|---|
| DNS | Resolvers match the VPN path, not the venue | Not logged yet |
| IPv6 | No unexpected IPv6 outside the tunnel (blocked or tunneled — know which) | Not logged yet |
| WebRTC | Browser does not expose a local/public IP that bypasses the tunnel | Not logged yet |
Failures get published as failures. “Mostly fine” is not a pass. When we publish a log, it will name the checker tools and versions we used.
Local-network snooping vs HTTPS (what a VPN does not replace)
A VPN encrypts traffic between your device and the VPN server. That shrinks what a casual neighbor on the same network, or a poorly segmented hotel network, can inspect of your outbound path.
It does not replace:
- HTTPS / TLS to the destination for content confidentiality with the site itself
- App transport security (mobile apps that pin certificates or use their own stacks)
- Device hygiene (malware on the laptop still sees everything after decryption)
If someone is phishing you into typing a password on a fake bank page, the VPN dutifully encrypts the path to the wrong place. Encryption of a bad decision is still a bad decision.
What a VPN does not fix
Keep this list next to any sales page that implies otherwise:
- Malware and shady downloads — a tunnel is not an antivirus. Threat-protection extras that some vendors market are separate features, not “the VPN” by default. Check what the current product docs actually promise.
- Phishing — an encrypted path is not a verified destination.
- Password reuse — credential stuffing does not care which exit IP you used.
- Site and ad tracking while logged in — Google, Meta, your bank, and the store you shop at still see account activity.
- Legal exposure for copyright infringement — a VPN does not legalize file sharing you are not allowed to do. We will not sell a “safe torrenting” story.
- Hostile physical access — someone watching your screen or unlocking your phone is outside the VPN’s job description.
- Captive portals — hotel, airport and café networks often use a sign-in or accept-terms page. The IETF describes a captive portal as a network where access is limited until some requirements have been fulfilled, typically in a web browser (RFC 8952, checked 13 November 2026). Mullvad notes that on such a network the connection can be unusable until you have logged in to the portal (Android leaks connectivity check traffic, 10 October 2022, checked 13 November 2026; Mullvad flags that post as possibly outdated). So if a VPN will not connect on hotel or café Wi‑Fi, an unfinished portal sign-in is one possible reason. The exact behavior depends on the venue, and we have not logged a specific one yet.
When skipping a VPN is reasonable
Skipping is a choice, not a moral failure. Reasonable cases:
- You are on a network you trust more than average (home, or a workplace with a known setup) and your threat model is ordinary browsing.
- You already use HTTPS everywhere that matters, a password manager, and OS updates — and you are not handling sensitive work on a random open network.
- A banking app refuses to run with the VPN on, and you only need that app for a few minutes. Mullvad has written that some financial institutions may reject a VPN connection, or even lock an account, if they detect a VPN (When is split tunneling useful?, 25 August 2021, checked 13 November 2026; Mullvad flags that post as possibly outdated). Proton similarly recommends trying a banking app on a secure network without a VPN first if access is denied (How to secure online banking with a VPN, 28 April 2022, checked 13 November 2026). Treat that as the bank’s policy, not proof the VPN failed. We have not logged a specific app.
- You need a password manager or a sharper eye for phishing more than a subscription. Sometimes the honest recommendation is: skip the VPN this month.
Fear copy that says “never connect without a VPN or you will be hacked” is not how we work. Evidence first.
When a VPN is the cheap insurance
A VPN earns its keep more often when:
- You regularly work from cafés, trains, airports, or hotels and want a consistent exit path and DNS behavior.
- You care about not handing the venue operator a clear view of every DNS query and destination IP pattern.
- You need a different exit region for a legitimate use case the vendor supports — and you accept that streaming or geo claims need dated logs, not eternal promises.
- You want a kill-switch so a dropped tunnel does not silently dump you onto the raw Wi‑Fi. For public Wi‑Fi use, we treat a working kill-switch as high-value. We have not published a drop test, so we do not treat a checkbox as proof.
“Cheap insurance” still means reading the renewal price, not only the intro banner, on the vendor’s own pricing page. If you are comparing who runs a service, where it is based, what it says about logs, and which audit it cites, start with our VPN Jurisdiction, Logging and Audit Comparison. Mullvad is listed there for information only. Mullvad says it does not have affiliates, does not pay for influencers, and does not even pay for links back to its site (Policy on reviews, advertising, influencers, and affiliates, last updated 15 May 2024, checked 13 November 2026). We will not use an affiliate link to Mullvad.
How we will demonstrate this
We do not stage “hacker in hoodie” stock photos as evidence. A demonstration, when we have one, means:
- Same device, same public Wi‑Fi (labeled in plain language: city or venue type, not a dramatized network name).
- VPN off: IP/ASN page, DNS/IPv6/WebRTC checks, short notes.
- VPN on: same checks, same hour, protocol and server region recorded.
- Optional: an intentional VPN drop with the kill-switch enabled — did traffic leak?
Until those logs exist, this page explains the comparison without pretending the lab notebook is full.
Paired session log:
| Field | Value |
|---|---|
| Date/time (Europe/Amsterdam) | Not logged yet |
| Venue type / location label | None logged yet. We will only name networks we actually used. |
| Device / OS / client | Not logged yet |
| Protocol | Not logged yet |
| VPN off IP/ASN | Not logged yet |
| VPN on IP/ASN | Not logged yet |
| DNS / IPv6 / WebRTC | Not logged yet |
| Speed difference, off vs on | Not logged yet |
Next step: choose without “#1” theater
If this page convinced you a VPN is worth trying on travel networks, do not crown a permanent winner from marketing alone. Compare intro and renewal prices on each vendor’s current pricing page, and use dated facts rather than eternal “#1” badges.
This article is educational. It is not a ranking page in disguise, and it is not a fear funnel.
FAQ
Do I need a VPN for every café visit?
No. Risk and convenience trade off. HTTPS still matters. A VPN helps most when you want consistent tunnel and DNS behavior and less venue visibility — not because every network is actively hostile.
Will a VPN break hotel captive portals?
The portal usually comes first. Access may be limited until you complete the venue’s sign-in page (see RFC 8952, checked 13 November 2026), and Mullvad notes the connection can be unusable until then. The exact behavior is venue-specific. We have not logged a specific hotel network.
What about banking apps?
Some banks may reject or flag a login from an unexpected IP address or country, which can include a VPN exit. Mullvad and Proton both describe this kind of conflict (pages checked 13 November 2026). Treat that as the bank’s policy, not proof the VPN “failed.” We have not logged a specific app.
Is a kill-switch mandatory?
For public Wi‑Fi use, we treat a working kill-switch as high-value. Test the failure mode; don’t trust the toggle alone. We have not published a drop test.
Are free VPNs fine for this?
Free tiers vary. Capacity, logging, and upsell pressure differ by vendor. Proton VPN’s free plan is a real product with published limits, not a stand-in for “free VPN” as a category. On 13 November 2026, Proton’s pricing page and plans page said the free plan costs $0.00 a month, allows one device at a time, and connects to servers in 10 countries (randomly selected). Proton also says the plan has no data limits and no artificial speed limits; the pricing page lists the speed as “medium.” Streaming and P2P are not included. Unknown free apps with invasive permissions are a hard pass.
Can a VPN stop phishing?
No. It encrypts a path. It does not verify that the page is your bank.
Does this make torrenting safe or legal?
No. We don’t advise illegal file sharing, and we don’t claim a VPN grants permission you don’t have.
Related reading
- VPN Jurisdiction, Logging and Audit Comparison
- Advertising and Affiliate Disclosure
- Privacy Policy
- Legal Notice
Last updated: 13 November 2026 (Europe/Amsterdam)
Paired Wi‑Fi log: None published yet
Operator: LiBrAi (eenmanszaak, KvK 42049145) — public brand Honest VPN Guide.