Privacy & Security

Public Wi-Fi Is Mostly Safe Now. When Do You Still Need a VPN?

By Rowan Pryce / November 14, 2026

An open laptop beside a latte and a glass of water on a wooden cafe table by a window

Quick answer: For ordinary browsing, banking and email, public Wi-Fi is usually safe now, because nearly every site and most apps encrypt the connection between your device and their servers. The FTC says so in plain terms. A VPN is no longer the default answer; it earns its place when you do not trust the network at all, when you would rather the venue not see which sites you visit, or when your employer requires one. The bigger risks are joining the wrong network, ignoring a browser warning and logging in on a fake site, and a VPN fixes none of those.

Key takeaways

The FTC’s consumer advice says that, because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe.
Google’s Transparency Report shows 95% of pages loaded in Chrome on Windows and 99% on Android used HTTPS in the week of November 8, 2026.
HTTPS hides what you do on a site, but not which site you visited or when. People on the same network can still see that.
The EFF says VPN advertising vastly oversells the benefits, and that a VPN moves your trust from the network to the VPN company rather than removing it.
Five free settings (HTTPS warnings, no auto-join, public network profile, private Wi-Fi address, updates) do more for most people than a subscription.

The advice you remember is about ten years old

You have probably been told that checking your bank account in a coffee shop is reckless. It was. It is rarely true now.

The FTC explains why the warning existed. In the early days, most websites did not scramble the data moving between your device and the site, so anyone snooping on a shared network could read it. Passwords included. The fix was websites switching to HTTPS, the encrypted version of the web’s basic protocol.

That switch is close to complete. Google has measured it since 2015 using Chrome users who share usage statistics. In March 2015, 39% of pages loaded in Chrome on Windows used HTTPS. In the week of November 8, 2026, the figure was 95% on Windows, 98% on Mac and 99% on Android. Google’s report says HTTPS protects against eavesdroppers, against someone sitting in the middle of the connection, and against hijackers who try to imitate a trusted website.

What someone on the same network can still see

“Usually safe” is not “invisible”. The EFF’s Surveillance Self-Defense guide, last reviewed in July 2026, is precise about the gap. HTTPS protects the content of what you send. It does not protect the metadata, meaning the information about the connection itself.

In practice, a person within range of the same network who chooses to listen in could usually see:

the domain names you visit (the site, not the page) and when you visit them;
the sizes of the pages you load and the files you upload or download.

They could not see which pages you read on those sites, your login name, or the messages you send. The EFF’s point is that your home internet provider sees the same metadata every day. If that level of exposure is acceptable to you, the guide says, you should not worry about using public Wi-Fi.

If it is not acceptable, for example you would rather the hotel not know which medical or job-hunting sites you opened, that is a real reason for a VPN. It is a privacy reason, not a security emergency.

Where the real risk is now

The danger has moved from the airwaves to the choices you make. Three situations matter.

The network is not the one you think it is

Anyone can name a hotspot “Airport Free WiFi”. If your device joins a look-alike network, its owner sits between you and the internet. HTTPS still protects the contents of your encrypted sessions, but you have handed a stranger your metadata and a chance to show you a fake sign-in page. Ask staff for the exact network name. Be wary of a Wi-Fi welcome page that wants anything more than a room number or a tick in a box, and never give it the password to your email or any other account.

The connection is not encrypted and you carry on anyway

A small share of sites still load without HTTPS. Chrome’s help pages describe the symbol to the left of the web address that shows whether the connection is secure, and a setting called “Always use secure connections” that makes Chrome ask before it uses an unsecured one. With it on, a site that does not support HTTPS triggers a “Your connection to this site is not secure” warning. On public Wi-Fi, treat that warning as a closed door.

The site itself is fake

This one catches people who feel safe. The FTC notes that scammers create fake websites and encrypt them, so the padlock appears. Your data is protected on the way there and then delivered, intact, to the scammer. Encryption tells you the line is private. It says nothing about who is on the other end.

What a VPN changes, and what it does not

A VPN (virtual private network) sends all your traffic through an encrypted tunnel to the VPN company’s server, and from there to the internet. Websites see the VPN server’s address instead of yours. The venue and its internet provider see only that you are connected to a VPN.

That is the whole product. The EFF says providers often advertise a VPN as the only tool you need against criminals, malware, surveillance and tracking, and that these adverts vastly oversell it. What the label does not say is where your browsing data goes instead: to the VPN provider, which can see everything the coffee shop could have seen, and could sell it.

Concern on public Wi-Fi	HTTPS alone	HTTPS plus a VPN
Someone nearby reading your passwords or messages	Protected	Protected
The venue seeing which sites you visit	Visible	Hidden from the venue, visible to the VPN company
A site that still loads without HTTPS	Exposed on the local network	Hidden on the local network
A fake website or phishing link	No protection	No protection
Tracking by cookies, apps and logged-in accounts	No protection	No protection
Malware or an out-of-date device	No protection	No protection

A VPN is also not an anonymity tool: GPS, cookies, tracking pixels and browser fingerprinting all work straight through it.

When a VPN is worth switching on

None of this makes VPNs useless. It makes them specific. Based on the EFF’s guide, a VPN is reasonable in these cases:

Work requires it. A corporate VPN connects you to the office network, and your IT department sets the rules. Use it as instructed. (Your employer can then see that traffic.)
You do not know who runs the network. An unlabelled hotspot abroad, a rental flat’s router, a conference network. If you must use it and you have a VPN you trust, the EFF says it may be useful.
You want to keep your browsing metadata from the venue. A fair choice, provided you trust the VPN company more than the hotel.
The network blocks sites you need. A VPN can get round some blocks, though streaming platforms increasingly block VPN connections in turn.

Five free settings that do more than a subscription

Do these once, at home, before the next trip.

Turn on HTTPS warnings. In Chrome, switch on “Always use secure connections” in the security settings. Other browsers have an equivalent HTTPS-only option.
Stop auto-joining public networks. Android’s help pages confirm that once you connect, a network is saved and your device reconnects automatically whenever it is nearby with Wi-Fi on. Remove saved cafe, hotel and airport networks when you leave.
Keep the network profile public on Windows. Microsoft says Windows 11 sets a new network as public by default and recommends leaving it. Your PC is then hidden from other devices and file and printer sharing is off. “Private” makes your PC discoverable; save it for networks where you know and trust everyone.
Leave Private Wi-Fi Address on. Apple devices give each network a different hardware address, so operators cannot easily follow one device across locations. On iOS 18 and later, the address rotates every two weeks by default on networks with weak or no security.
Update, and use two-factor authentication. The FTC’s list for any connection: strong passwords, two-factor authentication, and automatic updates for your operating system and browser.

If you buy one, read the small print

The EFF does not recommend any provider and says it cannot vouch for ratings. Its criteria are short. Treat "no logs" as a claim, not a guarantee, and read the privacy policy. Prefer providers that publish third-party security audits and name the people behind the company. Ask how the service pays its bills: a free VPN may be selling your data, and a subscription keeps charging if you forget to cancel. Look for the OpenVPN or WireGuard protocols, since the old PPTP protocol is broken. And do not assume an app is safe because an official app store lists it.

Frequently asked questions

Is it safe to use my banking app on hotel Wi-Fi?

Generally, yes. The FTC says most apps use encryption, and a bank’s app is among the likeliest to. Make sure you are on the hotel’s real network, keep the app and phone updated, and use two-factor authentication. If you are uneasy, switch to mobile data for that one task.

Does the padlock mean a website is trustworthy?

No. It means the connection is encrypted. The FTC warns that scammers encrypt fake sites too. Check the address itself, and reach your bank by typing the address or using its app rather than following a link.

Are free VPNs a good idea?

This is rarely a bargain. The EFF notes that a VPN can be entirely free and sell your data, which defeats the purpose.

Is my phone’s hotspot safer than public Wi-Fi?

It removes the shared network from the picture, so the venue and the people around you see nothing. Your mobile carrier still sees the same metadata any internet provider would. Set a strong hotspot password.