How to Use a VPN on Hotel Wi-Fi Safely

You arrive at a hotel after a long flight, tap the Wi-Fi name on the welcome card and find yourself on a page asking for your room number and surname. Within a minute you are checking email, banking apps and messages, often on a network shared by hundreds of guests you will never meet. Airports, cruise ships and aircraft cabins follow the same pattern. They hand out internet access to a crowd, usually behind a login page.

This article is about that specific situation. It explains what makes travel Wi-Fi different from a home connection, how those login pages (called captive portals) work, in what order to do things when you add a VPN and what to do when it will not cooperate. For the general principles of staying safe on any open network, see how to stay safer on public Wi-Fi. For a short step-by-step on the connection itself, the Help Center guide on connecting to a VPN on public Wi-Fi is the quick version.

Why hotel and travel Wi-Fi deserves extra care

A home network is yours. You chose the router, set the password and know who is on it. A hotel network is the opposite: you know none of those things. The Federal Trade Commission's guidance on public networks makes the same point. Many public networks are not secure, and other people on them may be able to see what you send if the connection is not protected.

Several features of hotel and travel networks raise the stakes a little:

• Many strangers on one network. Hotels, airports and ships put hundreds or thousands of devices on the same infrastructure. Any one of them might belong to someone with bad intentions.
• Shared or weak passwords. A password printed on a key card or poster is known to everyone. Some hotels use no password at all and only a portal page. A shared password does not mean the traffic is private between guests.
• Fake networks with similar names. Someone can create a hotspot called "Hotel_Guest_Free" or "Airport Free WiFi" and wait for devices to join it. The real network and the fake one look the same in the list.
• Network equipment you cannot inspect. Old or badly configured hotel equipment may not isolate guests from each other, and you have no way to check.
• You are more likely to be distracted. Tired, jet-lagged and in a hurry, people tap through warnings they would normally read.

None of this means you should stay offline. It means a few simple habits are worth the effort whenever you connect away from home.

How captive portals work

Most hotel, airport, café, cruise and in-flight networks use a captive portal. This is the page that appears when you first connect and asks you to accept terms, enter a room number, type an email address, watch an advert or pay for a plan.

Behind the scenes, the network lets your device join and give you an address, but blocks almost all traffic until you have completed the portal. The first time your phone or laptop tries to reach a website, the network redirects it to the portal page. Once you finish, the network records your device (usually by its hardware address) as authorised and lets the traffic through, often for a limited time such as 24 hours or the length of a stay.

Understanding this explains most of the odd behaviour people run into with a VPN:

• A VPN connection is just another kind of traffic. Until the portal is completed, the network blocks it, so the VPN cannot connect.
• If the VPN is already active when you join, the portal redirect may never reach your browser, because it is travelling through the tunnel to the VPN server rather than being intercepted by the hotel network. The page simply fails to load.
• Some portals reset the authorisation after a period, sending you back to the login page. If the VPN then drops, that is usually why.

Spot the real portal

A genuine hotel login page asks for details the hotel already knows, such as your room number and surname, or a code printed on your key card. Be cautious if a page asks for a payment card on a network that was meant to be free, requests your email password or tells you to install a certificate or app to continue. Messages like these are classic phishing tactics, and the CISA guidance on recognising phishing is a useful refresher. When in doubt, ask reception which network name is the official one.

The right order of steps

Getting the order right removes most of the frustration. Use this routine at a hotel, an airport, a lounge or on a ship:

1. Confirm the network name with staff. Check the exact name on the welcome card, a poster or with reception. Do not join a network just because it is open and has "hotel" or "free" in its name.
2. Connect to the Wi-Fi and open the portal. If the login page does not appear on its own, open any plain http:// address, or the address of the hotel's own page, to trigger it.
3. Complete the portal. Enter the room number, code or email and accept the terms.
4. Check that you have working internet. Load a web page. If nothing loads, fix the connection before starting the VPN.
5. Turn on the VPN. Open the VPN app and connect. Customers of XPASS use the free VPNclient app, signing in with the VPN username and password shown on their My Pass page.
6. Wait for the connected status, then verify. Open a website and, if you like, check your visible IP address to confirm the VPN is active. The Help Center guide on checking whether your VPN is working lists the steps.
7. Only then open sensitive apps. Email, banking and work accounts should wait until the VPN shows as connected.

If you ever forget the order and the portal will not load because the VPN is already on, switch the VPN off, complete the login page, then switch it back on.

What a VPN does on hotel Wi-Fi, and what it does not

A VPN creates an encrypted tunnel between your device and a server run by the VPN service. The hotel network sees only that tunnel, not the sites and apps inside it. Cloudflare's explainer on what a VPN is describes the idea well. On a network you do not trust, that is exactly the piece you are missing.

Concern	Does a VPN help?	Notes
Other guests trying to read traffic on the same network	Yes	The tunnel hides the content from the local network
Hotel or airport staff seeing which sites you visit	Mostly	They can see you use a VPN, not what is inside it
Fake network with a lookalike name	Partly	The tunnel limits what the fake network can read, but you should still avoid joining it
Phishing pages and fake logins	No	A VPN does not judge whether a page is genuine
Malware or an infected download	No	Keep your device updated and be careful what you install
A login page asking for too much	No	Your own judgement is the safeguard
Slow, congested network	No	A VPN cannot add bandwidth

Websites that use HTTPS already encrypt the content between your browser and the site, which is why the padlock matters. You can read more in HTTPS vs VPN. The two work as layers: HTTPS protects the content of each site, while a VPN also covers apps that do not use HTTPS and hides which sites you contact from the local network.

Hotel, airport, cruise and in-flight networks compared

The idea is the same everywhere, but each place has its own quirks.

Place	Typical set-up	What to expect with a VPN
Hotel	Portal asking for room number or code, often one login per device	Usually works once the portal is completed; re-login prompts may interrupt the VPN
Airport	Free access after accepting terms or watching an advert, often with a time limit	Works after the portal; sessions can expire and send you back to the start page
Lounge or café	Portal or a password on a poster	Similar to hotels, but with more people and less control
Cruise ship	Paid data plan through a satellite link, billed by time or volume	Often slow and high-delay; a VPN adds a little overhead and may need patience
In-flight	Paid or free tier through a satellite or air-to-ground link	Very limited bandwidth; some tiers only permit messaging, and some airlines restrict certain traffic

Airport Wi-Fi

Airports are busy, anonymous places where people of all kinds pass through. Joining a lookalike network is the main danger, so confirm the exact name from signage or the airport website. Once connected and past the portal, turn on the VPN before you check email or log in to anything. Airport sessions often expire after 30 or 60 minutes, and a fresh login page can interrupt the VPN, so check that it is still connected after a reconnect.

Cruise Wi-Fi

Ship connections usually run through satellite links, which have high delay and shared capacity. Packages are often charged by the minute or by the amount of data. This matters because a VPN uses a little extra data for encryption overhead, and slow links can make the connection time out. If the VPN connects slowly, give it a minute rather than repeatedly tapping connect. Turning off apps that sync in the background will also save your allowance.

In-flight Wi-Fi

Aircraft systems are the most restricted of all. Some airlines offer a free messaging tier that only allows certain apps, and a VPN will not work on that tier. Others charge for full access. Because bandwidth is shared across the whole cabin, expect everything to be slow. Read the airline's own terms, as the airline sets the rules for its network, and follow them. If the VPN does not connect, it may simply be a limit of the plan you have chosen, not a fault of the app.

A few real-life scenarios

The business traveller. Mia lands for a two-day work trip and connects to the hotel Wi-Fi before heading to a meeting. She completes the room-number portal, turns on the VPN and then opens her work email and a shared document. When she returns in the evening, the hotel portal has asked her to log in again. She disconnects the VPN, signs in to the portal and reconnects. The whole routine takes less than two minutes.

The student on a gap year. Daniel moves between hostels, each with a different network. In one, the portal page never loads. He realises the VPN was still connected from the last place. He turns it off, the portal appears, he logs in and turns the VPN back on. He now makes a habit of toggling the VPN off when arriving at a new network and on again once the portal is done.

The cruise passenger. Priya buys a 200 MB data plan for the voyage. She knows the link is slow, so she skips streaming and keeps the VPN for the few moments she checks her bank balance and messages. She turns off photo backup so the allowance is not eaten in the background.

The remote worker. Tom works from a hotel for a week. On day two the connection drops every hour or so. Because he checks that the VPN's kill switch is enabled where his app provides one, his work apps stop sending data when the tunnel drops instead of falling back silently to the hotel network. A short explainer on what a VPN kill switch is shows why this matters.

When the VPN will not connect

Travel networks are the place where VPN problems appear most often. Work through these in order:

1. Check that you passed the portal. Open a web page with the VPN off. If you are sent back to a login page, finish it first.
2. Look at the basics. Is Wi-Fi really connected and showing internet? Are airplane mode and a low-power mode switched off? Is the device date and time correct?
3. Wait a little. On slow links such as ships and aircraft, a connection can take longer than at home.
4. Reconnect the VPN. Disconnect, wait a few seconds, then connect again.
5. Change the connection method, if one is listed. Your My Pass page lists the connection methods and setup instructions for your pass. If the app offers an alternative method, a different one can sometimes get through a network that blocks the first.
6. Forget the Wi-Fi network and rejoin. This clears a stale session and can bring the portal back.
7. Try another network. Mobile data from your own phone, possibly shared as a hotspot, is a reliable fallback. If you travel abroad, check roaming costs with your carrier before relying on this.
8. Read the network's rules. Some networks restrict certain traffic, particularly in-flight tiers. If the network does not permit VPN traffic, respect that rather than looking for a workaround.

For persistent drops, the Help Center has a guide on improving VPN connection stability.

Common mistakes to avoid

• Turning the VPN on before the portal. This is the most frequent cause of "the Wi-Fi is connected but nothing loads".
• Trusting any network with the right-sounding name. Always confirm the exact name with staff.
• Ignoring certificate warnings. If your browser warns that a site's certificate is invalid, stop. Do not click through on a travel network.
• Handing over unnecessary details on the portal. Use only what is needed. A real hotel does not need your email password.
• Forgetting to check after a reconnect. Hotel networks may drop your session. Verify that the VPN is still connected before using sensitive apps.
• Leaving file sharing on. Turn off AirDrop, network discovery and file sharing on a laptop when on shared networks.
• Assuming the VPN fixes everything. It does not protect you from a phishing page, an infected file or a weak password.

A short checklist for your next trip

Before you leave:

• Install the VPN app and test the sign-in at home.
• Keep your VPN username and password somewhere you can retrieve them offline.
• Update your phone, laptop and browser.
• Turn on two-factor authentication for email and banking accounts.

On arrival:

• Confirm the network name, finish the portal and check the internet works.
• Turn on the VPN and verify the connected status.
• Turn off sharing features and use a normal user account on the laptop.
• Prefer HTTPS sites and look for the padlock.

For anything truly sensitive, such as a large bank transfer or a document with confidential data, mobile data from a SIM you trust is a cleaner choice than any shared Wi-Fi.

Summary

Hotel, airport, cruise and in-flight Wi-Fi share the same weakness: you are on a network you do not control, together with many strangers. A VPN helps by hiding your traffic from that local network, but it comes after the captive portal, not before it. Confirm the network name, complete the login page, check you have internet, then connect the VPN and verify it before opening anything sensitive. Keep realistic expectations on slow cruise and in-flight links, and remember that a VPN does not stop phishing or malware.

If you want a VPN ready for your next trip, the pricing page explains how a prepaid pass works.