Public Wi-Fi Security: What a VPN Does and Doesn't Do

Almost everything written about public Wi-Fi falls into one of two camps. One says it is a trap and you should never touch it without a VPN. The other says it is a myth, HTTPS has fixed everything and a VPN is pointless. Both are partly right and both are lazy. The truth is a list of specific threats, each with its own requirements and its own best defence.

This article takes that list apart. For each threat it explains what an attacker needs to pull it off, whether a VPN stops it, reduces it or does nothing, and what else you should do. If you want the quick version of the whole subject, staying safer on public Wi-Fi is the short checklist; this piece is the detailed map behind it. It deliberately does not repeat the airport and cafe scenarios covered elsewhere.

What "public Wi-Fi" changes

At home, you control the router and know who is on the network. On public Wi-Fi, three things change.

1. You share the local network with strangers.
2. The network operator controls the path your data takes to the internet. That might be a business, a venue, or a stranger who set up a hotspot.
3. You cannot inspect the equipment. You do not know the firmware, the settings, or whether anyone is monitoring it.

What does not change is that your data travels through many networks anyway, even at home. Your internet provider can see your destinations at home; public Wi-Fi simply adds new parties in the same position. The core job of a VPN, creating an encrypted tunnel from your device to a server run by the VPN provider, is described in the Cloudflare introduction to VPNs listed in the references. What matters here is which threats that tunnel stops.

Seven threats, one by one

Each threat below follows the same pattern: what it is, what the attacker needs, and what stops it.

Threat 1: Passive sniffing

What it is. Someone on the same network uses free tools to capture the data packets that travel through the air or the router.

What they need. A laptop, free software and proximity. No special skill beyond following a tutorial.

What it gets them today. On an open (no password) network, the packets are readable in the sense that they can be captured. But if the page uses HTTPS, the contents are encrypted with TLS, so they see little more than the site name and the amount of data. Old apps, some games, some smart-home gadgets and badly written software may still send data unencrypted.

Does a VPN stop it? Yes. The tunnel encrypts all traffic from your device to the VPN server, including from apps that do not use encryption, so a sniffer sees only that you are connected to the VPN server.

Other defences. Prefer WPA2 or WPA3 networks with a password, use HTTPS everywhere, and keep your apps updated.

Threat 2: Fake hotspots (evil twins)

What it is. A hotspot named like a legitimate one, set up to attract devices.

What they need. A router or a laptop that can act as an access point, and a plausible name.

What it gets them. Once your device joins, every packet goes through their equipment. They can see the metadata of your traffic and try to tamper with it, serve fake login pages or block things.

Does a VPN stop it? Partly. The tunnel limits what they can read, because the content and destinations are inside the encryption. But they still control your first hop: they can block the VPN so you fall back to nothing, show you a fake sign-in page and persuade you to type something, or simply stop your connection. The VPN does not authenticate the hotspot.

Other defences. Confirm the exact name with staff, forget old networks, turn off auto-join, and use mobile data for sensitive tasks. A kill switch, explained in what a kill switch is, prevents your traffic from leaking outside the tunnel if the VPN drops.

Threat 3: Man-in-the-middle and downgrade tricks

What it is. An attacker sits between your device and a site, tries to read or change traffic, for example by tricking your browser into using an unencrypted version of a site, or presenting a fake security certificate.

What they need. Control of the network path, which a fake hotspot or a compromised router gives them, and a victim who clicks through warnings.

What stops it. Mainly TLS and your browser. Modern browsers verify certificates, warn loudly when something is wrong and, for many sites, refuse to load the unencrypted version at all. The TLS 1.3 specification (RFC 8446), listed in the references, is the technical backbone.

Does a VPN stop it? It adds a layer: the attacker on the local network cannot read or alter traffic inside the tunnel. It does not protect you if you ignore a browser warning on a site beyond the VPN. Keep your browser updated and never click through a certificate warning to log in to something important.

Threat 4: DNS tricks

What it is. DNS turns a name like example.com into an address. A hostile network can answer with the wrong address, sending you to a fake site, or simply record the names you look up.

What they need. Control of the DNS answers on the network, which is typical for the router of a hotspot.

What it gets them. A list of the sites you ask for, and the ability to redirect you to a look-alike page. HTTPS and certificates limit the damage of redirection, but the record of your lookups remains visible.

Does a VPN stop it? Yes, if your DNS requests actually go through the tunnel. A VPN that leaks DNS to the local network gives up this protection. What a DNS leak is explains how to check, and DNS over HTTPS vs VPN compares the two options for protecting lookups.

Threat 5: Session and cookie theft

What it is. Instead of stealing your password, an attacker steals the small token a site gives your browser after you log in, and uses it to act as you.

What they need. Access to the token, which is easy on an unencrypted connection and much harder on HTTPS. It is also stolen by malware on your device or by a malicious browser extension.

Does a VPN stop it? It helps on the network path, because the token travels inside the tunnel. It does nothing about tokens stolen from your device itself.

Other defences. Log out of sensitive sites, keep browser extensions to a minimum, and use two-factor authentication, which makes a stolen password less useful. What is two-factor authentication covers the choices.

Threat 6: Phishing and fake login pages

What it is. A message, a pop-up or a page that looks like a bank, airline or Wi-Fi provider and asks for your details.

What they need. Nothing about the network. A phishing email works the same at home, in a cafe or on a train.

Does a VPN stop it? No. A VPN is not a judge of whether a page is genuine. It will encrypt the connection to the fake site just as faithfully as to the real one.

Other defences. Learn the signs in how to recognize phishing websites, use a password manager that fills in only on the correct domain, and follow the guidance from CISA on recognising and reporting phishing.

Public Wi-Fi adds one twist: a "sign in to continue" page that asks for more than it should. A genuine network login asks for an email address, a code or a room number. It does not ask for your bank password.

Threat 7: Malware and unsafe downloads

What it is. Software that harms your device or steals data, delivered through a fake update, a bad download or a malicious attachment.

What they need. You to run it.

Does a VPN stop it? No. A VPN does not scan files or block harmful programs. It protects the transport, not the contents of what you choose to download.

Other defences. Install updates from the operating system's own mechanism, download software from official sources, keep a basic security tool active, and treat any pop-up that says your device is infected or needs a special update as suspicious. See VPN vs antivirus vs firewall for how the layers split the work.

The scorecard

Threat on public Wi-Fi	VPN effect	Best additional defence
Passive sniffing	Stops it	WPA2 or WPA3, HTTPS
Fake hotspot	Reduces what can be read	Confirm network name, mobile data
Man-in-the-middle and downgrade	Adds a layer	Updated browser, heed warnings
DNS tricks	Stops it if no DNS leak	Check for leaks
Session and cookie theft	Helps in transit	Log out, two-factor authentication
Phishing	None	Learn the signs, password manager
Malware	None	Updates, trusted sources, security tool
Physical theft or shoulder surfing	None	Screen lock, privacy filter
Account takeover from a reused password	None	Unique passwords, two-factor authentication

Notice that a VPN fully addresses only the first and fourth rows, and helps with parts of two others. That is not a flaw; it is what a transport-level tool is. It explains why articles such as what a VPN cannot protect you from insist on pairing it with habits.

Where the VPN itself becomes a risk

Moving trust is not the same as removing it. A VPN means the provider's servers see what your local network used to see: where your traffic goes, though not the contents of properly encrypted pages. That is why the choice of provider matters and why unknown free apps are a particular concern. Before relying on one, read is a VPN safe and are free VPNs safe.

There is also the question of whether a VPN itself can fail. Misconfiguration, outdated software or a bug can cause leaks, and can a VPN be hacked discusses what that does and does not mean. Test your VPN rather than assuming; the steps are in how to check if your VPN is working.

A layered defence for public Wi-Fi

Think of five layers. A VPN is only one of them.

1. Network choice. Confirm the exact name, avoid open networks where possible, and use mobile data for the most sensitive tasks.
2. Transport protection. HTTPS everywhere and a VPN on shared networks.
3. Device hygiene. Updates, a lock screen, a security tool, no unknown apps or profiles.
4. Account protection. A password manager, unique passwords and two-factor authentication or passkeys.
5. Behaviour. Do not log in from pop-ups, do not click unexpected links, and keep sensitive tasks for safer networks.

A weakness in one layer is covered by another. If you fall for a phishing page (layer 5), strong two-factor authentication (layer 4) is the thing that saves the account, and no VPN can.

Putting it into practice

A realistic routine for a day on shared networks:

1. Before you go out: update devices, charge fully, check that the VPN app is installed and signed in.
2. On joining a network: confirm the name, pass any sign-in page with the VPN off, then connect the VPN. The help article on connecting to a VPN on public Wi-Fi lists the steps.
3. During use: use the VPN for browsing, mail, chat and work; use mobile data for banking and anything you cannot afford to lose.
4. When something looks wrong (a certificate warning, an unexpected login prompt, a page you do not recognise), stop and switch to mobile data.
5. When you leave: disconnect, forget the network, log out of shared devices.

With XPASS, the VPN piece is the free VPNclient app, which you sign in to with the username and password on your My Pass page.

Common misunderstandings

• "A VPN makes public Wi-Fi totally safe." No. It covers the network layer, not phishing, malware or account theft.
• "HTTPS makes a VPN pointless." No. HTTPS protects page content; a VPN also hides your destinations and covers apps that skip encryption.
• "A padlock means the site is trustworthy." No. It means the connection is encrypted. Fake sites can have padlocks too.
• "If the Wi-Fi has a password, it is private." No. Everyone who has the password is on the same network.
• "Private browsing mode hides me on public Wi-Fi." No. It only changes what your browser saves locally.

Summary

On public Wi-Fi a VPN reliably stops passive sniffing, reduces what a hostile hotspot or router can read, and protects your DNS lookups when it is set up without leaks. It does nothing against phishing, malware, weak or reused passwords, or someone looking at your screen. Treat it as the transport layer in a five-layer defence that also includes network choice, device updates, strong account protection and careful behaviour, and use mobile data for the most sensitive tasks.

If you want to add that transport layer with a prepaid pass that ends on its own, the pricing page shows the options, and the download page lists the free VPNclient app for your device.