Can Hackers See Your Data on Public Wi-Fi with a VPN?

Most people picture a hacker on public Wi-Fi as someone in a hoodie who watches every page you open. With a VPN on, that picture is mostly wrong, but not completely. The more useful question is not whether you are "safe" but which specific things an attacker sitting at the next table can still learn or do, and which things the tunnel genuinely takes away from them.

This article answers that for the exact scenario in the title: a VPN running on a cafe, hotel, airport or coworking network. It walks through what stays hidden, what still shows, which attacks a VPN does not touch, and a short routine you can follow. For the wider habits around shared networks, see how to stay safer on public Wi-Fi.

What an attacker on the same Wi-Fi can do without a VPN

To judge what a VPN removes, start with what is possible without one. Anyone connected to the same access point shares the same radio space and, on many networks, the same local network segment. A person with basic tools can do the following.

• Watch the network passively. On an open network, or one with a shared password, other users may be able to capture traffic that passes through the air. Modern sites hide page content with HTTPS, but the destination names and the volume of data are still visible.
• See which sites you contact. Even when the page content is encrypted, the domain you ask for is normally visible to the network owner and to anyone watching the connection.
• Run a fake hotspot. A rogue device can copy the name of the genuine network. Phones that auto-join known names may connect without you noticing.
• Redirect you. On badly managed networks, an attacker can try to answer your device's questions with false information so that a request for one address ends up somewhere else.
• Probe your device. Other computers on the same network can try to reach file sharing, remote desktop or other services on your laptop if those are switched on.

These are the reasons consumer agencies advise caution on shared networks. The US Federal Trade Commission explains the risks of public Wi-Fi in plain terms, and its advice about HTTPS and updates still applies once a VPN is running.

What the VPN tunnel takes away from them

When your VPN is connected, your device wraps its internet traffic in an encrypted tunnel to a VPN server and sends only that wrapped stream across the Wi-Fi. Read the Cloudflare explanation of a VPN if you want the mechanics; the result for a shared network is this.

Thing the attacker wants	Without VPN	With VPN connected
Which websites you open	Visible as domain names	Hidden inside the tunnel
Content of unencrypted pages and apps	Readable	Hidden
Your DNS lookups	Visible on the local network	Sent inside the tunnel when the app handles DNS correctly
Quiet redirection of requests on the local network	Possible on weak networks	Much harder, since your traffic does not travel as plain local requests
Which apps are talking in the background	Often guessable	Not visible

So the main gain is concealment of content and destination. A person in the next seat who captures your Wi-Fi traffic ends up with scrambled data addressed to a single VPN endpoint.

That gain is larger on some devices than others. Phones and laptops constantly talk to servers in the background for updates, sync, backups and notifications. Many of those connections are not something you click, so you cannot judge them by looking at a padlock. A tunnel covers all of them at once, which is why it is useful even if you only browse "safe" sites.

What still shows on the network even with a VPN

Be exact about the leftovers, because this is where overconfidence causes trouble.

1. That you are on the network. The access point sees your device's hardware address and its connection. Many phones randomise this address per network, which helps, but it is not universal.
2. That you are using a VPN. The observer sees traffic to one address that behaves like a tunnel. They cannot read it, but they can often tell that it is one.
3. How much and when. Volume and timing are visible. A large steady flow looks like video; short bursts look like messaging. Nobody can read the content, but patterns exist.
4. The VPN server address. Your device has to contact the VPN server to start the tunnel, and that address is visible.
5. Anything before the tunnel is up. If the VPN is not yet connected, or has dropped, your traffic goes out in the open until it reconnects.

That last point is the practical weak spot. Phones and laptops send traffic the moment they join a network: mail checks, app updates, cloud sync. If you connect the VPN thirty seconds after joining, those first requests have already gone out unprotected. A kill switch, where your VPN app offers one, reduces this; see what a VPN kill switch is for how it works.

Attacks a VPN does not stop on public Wi-Fi

The network is only one place where things go wrong. A VPN does nothing about the following.

• Fake login pages. The captive portal on many cafe networks asks you to accept terms or enter an email. A copycat network can show a page that asks for more: a card number, a social account password, a phone number. The VPN does not judge whether a page is honest. The CISA guidance on recognising phishing, and our piece on recognising phishing websites, are the right tools here.
• Malware on your device. If something malicious is already installed, or you install it from a "required update" prompt on a hotspot page, it can read data before the tunnel encrypts it.
• Weak or reused passwords. A VPN does not make a leaked password useless. Two-factor authentication does that.
• Bad permissions on your own device. File sharing, screen sharing and remote login should be off when you travel.
• Someone looking at your screen. Shoulder surfing is a human problem.

For the broader list, read what a VPN cannot protect you from.

Does HTTPS already cover this?

Largely, for web pages. When a site uses HTTPS, the content of the page, the form you submit and the cookies sent along are encrypted between your browser and the site. An attacker on the Wi-Fi cannot read your password just by watching. Our comparison of HTTPS and a VPN goes through the division of labour in detail.

What HTTPS does not hide is the site name, and it only covers traffic that actually uses it. A few examples of where the gap matters on a shared network:

• An app that talks to its own servers over a poorly set up connection.
• A smart-home or printing device on the local network.
• A connection to a site that quietly downgrades to plain HTTP because you typed the address without the secure prefix.
• Background services that report to a company without any visible padlock.

If you rely on HTTPS alone, you cover the browser very well and the rest unevenly. A VPN evens that out. If you use both, a person watching the Wi-Fi sees neither the page content nor the site names.

A realistic scenario: the airport coffee shop

Take a traveller named Sara waiting for a delayed flight. She joins "Airport_Free_WiFi", accepts the terms page, opens her mail and checks a bank balance.

What an attacker with a laptop nearby could have done, with no VPN: note that she visited her bank's domain, note that she is using a mail service, and, if she had joined a fake hotspot with the same name, show her a convincing login page of its own.

What changes if she connects her VPN right after the terms page:

1. Her mail and bank traffic is wrapped inside the tunnel, so the attacker sees only encrypted data to one address.
2. The attacker can still see that she is using a VPN and roughly how much data she moves.
3. If the hotspot was fake and asked for her mail password, the VPN would not have helped. She needs to notice that a free Wi-Fi page asking for a mail password is wrong.

The third point is the lesson. A VPN reduced one risk and left another untouched. The remaining protection comes from Sara's habits, which is why the routine below matters as much as the tool.

A short routine that actually works

You do not need a long checklist. Five steps cover most of it.

1. Confirm the network name with staff or a sign, and ignore similar names.
2. Turn off auto-join for open networks on your phone and laptop, and delete old hotspots you no longer use.
3. Connect the VPN immediately after any terms or login page, before opening sensitive apps. If you use the XPASS VPN setup, the steps are in connecting to a VPN on public Wi-Fi.
4. Check the padlock and the address before entering a password, and use two-factor authentication on mail, banking and social accounts.
5. Disconnect and forget the network when you leave, and keep system and app updates current.

If a hotspot seems to refuse VPN traffic, some networks do restrict it. Use your phone's mobile data for sensitive tasks instead of looking for a clever workaround. Hotel networks have their own quirks, covered in using a VPN on hotel Wi-Fi.

Common mistakes

• Assuming "VPN on" means "everything is safe". The tunnel covers the network path only.
• Connecting late. The first minute after joining is the exposed one.
• Ignoring a VPN that has silently dropped. A weak signal can disconnect it. Look at the status icon before you log in.
• Entering personal details on the Wi-Fi sign-up page. Give the least you can, and use a throwaway address if an email is required.
• Treating a free VPN app as equal. Some free apps collect more than they protect; see whether free VPNs are safe before installing one on a hotspot.
• Using a shared or borrowed computer. A keylogger on the machine defeats any tunnel.

Summary

With a VPN on, a person on the same public Wi-Fi cannot read your pages, messages or lookups, only that you are connected, that you are using a tunnel, and roughly how much data you send. What the VPN does not stop is just as important: fake login pages, malware, weak passwords, the unprotected moments before the tunnel starts, and a rogue hotspot you joined by mistake. Pair the VPN with careful joining, quick connection, updates and two-factor authentication.

If you want a simple option for a trip or a few weeks of cafe working, you can look at the pricing page at your own pace.