Do you need a VPN on public Wi-Fi?

A VPN is useful on public Wi-Fi but not magic. Modern HTTPS already encrypts the content of most web traffic, so a coffee shop network cannot read it. A VPN adds a protected tunnel for everything else and hides which sites you visit from the local network, while shifting that visibility to the VPN operator.

What can someone on the same Wi-Fi see?

On an open network with no password, other devices share the radio medium and the network operator controls the router. Without encryption at the Wi-Fi layer, a nearby device could capture traffic. Even on a shared password network, the operator can see which hosts you contact.

What they see depends on what your traffic uses. NIST SP 800-52 Rev. 2, the guide for TLS, covers how TLS protects data in transit across the internet. When a site uses HTTPS properly, the page content, form data and cookies are encrypted between your browser and the server. The network still learns the domain name in most cases, from the DNS request and the TLS handshake, and it can see the volume and timing of your traffic.

Older or poorly built apps are the risk: those that use plain HTTP, send data without encryption, or ignore certificate errors.

What does a VPN change?

A VPN client builds an encrypted tunnel from your device to a VPN server. The Wi-Fi network sees only that tunnel, plus the address of the VPN server. Your traffic then exits from the VPN server to the wider internet.

NIST SP 800-77 Rev. 1 describes IPsec as a framework for private communications over IP networks and covers when VPN style protection fits and what alternatives exist. The same logic applies to other VPN protocols: protection runs from you to the VPN endpoint, not all the way to the destination.

Two consequences follow.

• Local snooping and tampering become much harder, including for apps that do not use encryption.
• The VPN operator now sees what the Wi-Fi owner used to see. You are choosing whom to trust.

What does a VPN not fix?

• Phishing sites with valid HTTPS certificates.
• Malware on your device.
• Logging in to an account that is already compromised.
• Fake access points with a lookalike name. If you join the wrong network, a VPN helps, but a DNS leak or a captive portal page can still expose details first.

NIST SP 800-153 on wireless local area network security stresses that the security of a wireless network depends on how the whole system is configured and monitored. That is the operator's job. As a user on someone else's network, you cannot verify any of it.

When should a person or company use one?

A constructed example: a sales rep travels weekly and joins hotel Wi-Fi to reach the company's internal wiki and a legacy tool that uses an old protocol. A company VPN, or better a zero trust access service, protects that old tool and gives the company logs and policy. For the same rep, a personal consumer VPN mostly changes who sees browsing metadata.

A company VPN also handles a different problem, reaching private resources, which is why teams often keep one even when public sites use HTTPS.

How to check or apply this

1. Prefer your phone's hotspot for sensitive work. You control the access point.
2. If you use public Wi-Fi, confirm sites show HTTPS and heed certificate warnings.
3. Choose a VPN you can name, with a published policy on logging and a way to audit it. Avoid free services whose business model you cannot explain.
4. Turn on the kill switch so traffic stops if the tunnel drops.
5. Keep devices updated and use multi-factor authentication on every account that offers it.
6. For work, use the company's approved remote access method, not a personal tool.

Quick check

Sources

• NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations
• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• NIST SP 800-153, Guidelines for Securing WLANs

Last reviewed: 18 October 2026.