What a VPN does on public Wi‑Fi

A VPN (Virtual Private Network) creates a secure, encrypted “tunnel” between your device and a VPN server. On public Wi‑Fi in hotels or cafés, other people and certain network devices may be able to observe traffic patterns or interfere with unprotected connections. With a VPN, the data leaving your device is encrypted, so on the local Wi‑Fi network it is far harder to read.

In practical terms, this mainly protects the portion of your communication that would otherwise travel in the clear (or be easier to analyze) between you and the wider internet.

How the protection works

When you connect to a VPN, your phone or laptop typically:

  1. Establishes the VPN tunnel to the VPN server.
  2. Encrypts the traffic you generate (web browsing, messaging, downloads) before it goes onto the local Wi‑Fi.
  3. Sends that encrypted traffic over the tunnel, where it is decrypted only at the VPN server.
  4. For websites and services you use, the server you connect to generally sees the VPN server’s IP address rather than your device’s IP address.

Two common security benefits follow from this:

  • Confidentiality on the Wi‑Fi segment: others on the same network are less able to view the contents of your traffic.
  • Reduced tampering visibility: if someone tries to interfere, encryption makes it much more difficult to alter or inject usable content without breaking the cryptography.

It’s also helpful to remember what remains visible at different layers. Even with encryption, network operators may still see that you are using a VPN and can often observe timing and traffic volume.

What a VPN does not protect you from

A VPN is not a universal shield. Key limitations include:

  • Malware and unsafe apps: if your device is already compromised, a VPN can’t remove malware or fix malicious permissions.
  • Phishing and fake logins: if you enter credentials into a fraudulent site, encryption of the connection won’t prevent the scam.
  • Insecure endpoints: if the application you use is insecure (or you’re using weak account security), the VPN won’t automatically fix that.
  • You still have to trust the browsing/service you use: the VPN only changes how your traffic travels between your device and the VPN server; it doesn’t guarantee that every website or service is legitimate.

Also, avoid the common misconception that a VPN makes you “fully anonymous.” Your online activity still involves accounts, device behavior, and application data. Different parties may be able to correlate activity depending on how you use services.

Practical checks when you’re using public Wi‑Fi

Use these checks to confirm the VPN is actually providing the protection you expect and to avoid false confidence:

  1. Verify the VPN is connected before you handle sensitive activity. If the VPN disconnects, traffic may revert to the regular Wi‑Fi path.
  2. Check DNS behavior: even when browsing looks normal, DNS handling can affect privacy. Prefer a setup where DNS requests are routed through the VPN tunnel.
  3. Look for HTTPS on websites: a VPN helps with transport protection, but HTTPS is still important for end-to-end protection between your device (or the VPN tunnel endpoint) and the website.
  4. Be cautious with captive portals and logins: hotels and cafés sometimes require a web login page. These flows can be legitimate, but you should ensure you’re on the expected portal and avoid entering credentials into pages that look suspicious.
  5. Keep your device updated: VPNs don’t replace patching, browser security updates, or basic safeguards.

If something feels off—unexpected certificate warnings, repeated redirects, or login pages that don’t match the service’s usual appearance—treat it as a red flag and stop instead of relying on the VPN.

It’s easy to mix up different protections:

  • HTTPS/TLS encrypts traffic between your device (or browser) and a specific website.
  • A VPN encrypts traffic between your device and the VPN server, covering many destinations through one encrypted tunnel.
  • Using both is common: HTTPS protects end-to-end with the website, while the VPN reduces exposure on the local network segment.

Finally, threat models matter. A VPN helps most against common public‑Wi‑Fi risks like passive eavesdropping and some forms of network interference. It helps less against issues rooted in your device, your accounts, or the websites you choose to trust.