Public Wi-Fi And VPNs: What Is Actually Risky In 2026
Public Wi-Fi got safer over the last decade, and most warnings about it are a decade out of date. But the risks that remain are real, and they are not the ones people usually worry about. Here is the current picture.
What actually goes wrong on open networks
- Evil twin hotspots. Someone sets up a network named like the real one ("Airport_WiFi_Free"). You join it, and every request goes through their laptop first. This is cheap to do and still works.
- Metadata leakage. Even with HTTPS, whoever runs the network can see the domains you connect to. Not the contents, but the pattern: your bank, your health provider, your dating app.
- DNS manipulation. A hostile network can answer your lookups with the wrong address and steer you to a lookalike site.
- Sloppy apps. Most apps encrypt properly now. Some still do not, especially older or niche ones, and you have no way to tell from the outside.
Auto-connect on untrusted Wi-Fi means it protects you even when you forget to tap connect.
GET NORDVPN →This page uses paid affiliate links. If you buy through them, we may earn a commission at no extra cost to you. It never changes what we recommend.
The five-second checklist for the gym café, hotels and airports
- Turn off automatic joining of open networks in your phone settings. This is what gets people onto evil twins.
- Ask staff for the actual network name rather than guessing from the list.
- Turn on your VPN, ideally with auto-connect so it happens without you thinking about it.
- Keep file sharing and AirDrop-style features off in public.
- Save anything genuinely sensitive for a network you trust, even with a VPN on. Layers, not magic.
What a VPN does not fix
It does not stop malware, it does not help if you type your password into a phishing page, and it does not protect you from someone reading your screen over your shoulder. It solves the network layer. The rest is still on you.
One subscription covers your phone and laptop on the same trip.
GET NORDVPN →This page uses paid affiliate links. If you buy through them, we may earn a commission at no extra cost to you. It never changes what we recommend.
Quick answers
Is public Wi-Fi actually dangerous?
Less than it was, more than nothing. HTTPS encrypts most traffic, so classic password sniffing rarely works. The remaining risks are fake hotspots, DNS manipulation, and apps that still send data insecurely.
Does a VPN protect me on public Wi-Fi?
Yes, for network-level risks. It encrypts everything between your device and the VPN server, so a rogue hotspot sees only an encrypted tunnel.
Should I use mobile data instead?
If you have the allowance, that is a reasonable alternative, since carrier networks are harder to impersonate. A VPN is the better answer when Wi-Fi is your only option.