On most public Wi‑Fi today, HTTPS already encrypts what you send to your bank’s app or a shopping site, so someone else on the same network can’t simply read your passwords or messages. What HTTPS doesn’t hide from the hotspot operator is which services you’re talking to: the DNS lookups your phone makes and the destination address or server name that goes out before the encrypted part of a connection starts. That operator — or anyone who has slipped onto the hotspot — can also run a look‑alike network or a fake sign-in page to catch you before you reach an encrypted site. A VPN adds its own encrypted tunnel to a server you choose, so the local network sees far less, but that visibility doesn’t disappear; it moves to the VPN provider instead. On a network you don’t control, that trade is usually reasonable, with a few honest limits below.
What the Wi-Fi operator can and can’t see
“Operator” means whoever controls the hotspot, plus anyone who has slipped onto it. The split looks like this:
| What’s visible | With HTTPS only | With a VPN |
|---|---|---|
| Page content — passwords, messages, card numbers | Encrypted on sites using HTTPS correctly | Also encrypted, inside the VPN tunnel |
| Which sites or apps you use (DNS lookups, destination, server name) | Often visible to the network | Hidden from the hotspot; visible to the VPN provider |
| That you’re online, and roughly how much data you send | Visible | Visible, attributed to one VPN connection |
| Whether the hotspot itself is genuine or a look-alike | Not checked by HTTPS | Not checked by a VPN either |
A VPN changes who can see your traffic; it doesn’t make it invisible to everyone. The DNS vs VPN guide covers the DNS row in more detail — a DNS request and an HTTPS connection are separate things.
Real risks on public Wi-Fi
The risk on a coffee-shop or airport network usually isn’t that HTTPS fails; it’s the things around it.
- Evil twin hotspots. An attacker sets up an access point with the same or a similar name as the real one, sometimes with a stronger signal, so nearby devices connect to it instead. CISA’s guidance on wireless networks describes an attacker impersonating a legitimate access point to read data a victim sends over the internet, and advises confirming the exact network name with staff before connecting.
- Captive portals. The sign-in page many hotels and airports show before granting internet access has to load in the clear, before a VPN — or sometimes even HTTPS — can help. It’s also a page a scammer could imitate.
- Apps and sites that don’t enforce HTTPS everywhere. Most traffic is encrypted, but not all of it, and a password-protected hotspot is a separate protection from an encrypted website. The FTC’s public Wi-Fi guidance puts it plainly: secure hotspots require a password, and secure websites start with https.
- DNS lookups. Turning a name like your bank’s domain into an address is a separate step from loading the page, one the local network can often see even when the page itself is encrypted. Try the DNS lookup tool to see what that kind of request returns.
When a VPN helps — and when it doesn’t
A VPN helps most with the network itself: once connected, the hotspot mainly sees an encrypted tunnel to one server, rather than a list of domains and services you’re reaching. That reduces what a stranger on the same Wi-Fi can learn about you.
It doesn’t help with the rest. A VPN can’t tell a genuine hotspot from an evil twin, and it can’t stop you typing a password into a convincing fake sign-in page — the tunnel just carries that mistake along too. It doesn’t stop malware in a download, and it doesn’t change what a website already knows once you sign into an account there; as the VPN vs private browsing guide covers, the account still identifies you. EFF’s guide to choosing a VPN is direct about the trade-off: your traffic becomes visible to the VPN provider instead of the local network, so the provider you pick matters as much as the decision to use one.
A safer public Wi-Fi routine
A short routine covers most of the above:
- Confirm the exact network name (and password, if any) with staff, rather than picking the first similar-looking option.
- If a captive portal sign-in page appears, finish it first — a VPN turned on too early can keep it from loading.
- Connect your VPN, then check your address actually changed at VVPN’s public IP checker. The IP check guide explains what a changed, or unchanged, result does and doesn’t prove.
- Watch for your browser’s “not secure” warning on individual sites; a VPN doesn’t make an insecure site secure.
- Avoid signing into anything sensitive on a network you don’t trust, VPN connected or not.
- When you leave, forget the network so your phone doesn’t rejoin it automatically later.
Get started
If you want to try this routine on your phone, VVPN is free to download on Google Play and the App Store, with no account registration needed to get started. Set it up with the Android setup guide or the iPhone setup guide, then use the checklist above next time you’re on a network you don’t control.
Sources
- FTC: Public Wi-Fi Networks — Security Tips — on public Wi-Fi encryption and checking for HTTPS.
- CISA: Securing Wireless Networks — on evil twin hotspots and confirming a network’s name before connecting.
- EFF: Choosing the VPN that’s right for you — on what a VPN hides from a local network, and why the provider you choose becomes the party you trust instead.
- Google Chrome Help: Check if a site’s connection is secure — on what HTTPS protects and what browser security warnings mean.
