KovraThe standard warning about public Wi-Fi — hackers sniffing your passwords out of the air — describes a world that mostly ended when the web moved to HTTPS. Repeating it has an unfortunate side effect: people who learn it was overstated conclude the whole topic is marketing. The real risks are narrower, less dramatic and still worth addressing.
What HTTPS already solved
Any site worth logging into uses TLS, browsers now warn loudly on anything that does not, and HSTS prevents silent downgrades on sites that have been visited before. The contents of your sessions — the pages, the form fields, the credentials — are encrypted between your device and the server, and no one on the local network can read them. That is a genuine, structural fix, and it removed the original reason to fear the coffee shop.
What it did not solve
The destination list
Encryption hides content, not addressing. Anyone on the network segment, and the network operator by default, can observe which servers you contact: through DNS queries, through the hostname in the TLS handshake, and through IP addresses. A list of every site and app you touched, with timestamps, is a meaningful profile — health services, employers, banks, dating apps, news outlets — even with every page unreadable.
Captive portals
The "accept terms to connect" page works by intercepting traffic, which means every venue network ships with an interception mechanism turned on by design. Most only redirect until you accept, but the capability is there, it is often implemented by a third-party vendor, and the portal itself frequently collects an email address or a phone number tied to your device.
Rogue access points
The realistic attack today. An access point named identically to the venue's, with a stronger signal, and devices join it automatically because the name matches a saved network. The operator then sees the same metadata as above and can serve convincing phishing pages for anything you reach by typing a name rather than following a bookmark.
Devices on the same segment
On networks without client isolation, other guests can scan your device. Shared folders, media servers, printer services and debug ports left open at home are all reachable from the next table.
What a VPN changes, precisely
| Risk | Without VPN | With VPN |
|---|---|---|
| Reading HTTPS content | Not possible | Not possible |
| Seeing which sites you visit | Visible via DNS and SNI | Hidden |
| Plain HTTP content | Readable and modifiable | Protected inside the tunnel |
| Captive portal interception | Full | Limited to before you connect |
| Rogue access point profiling | Effective | Sees only one encrypted stream |
| Local network scanning | Possible | Unchanged — firewall handles this |
| Phishing page you type into | Works | Still works — a VPN is not an anti-phishing tool |
The five-minute setup that covers it
- Turn on automatic connection for untrusted networks. The gap between joining and connecting manually is when your mail client syncs.
- Enable the kill switch, so a dropped tunnel does not resume in clear text on a network you do not control.
- Turn off automatic joining of open networks in the operating system. This is what rogue access points exploit.
- Set the network as public when the system asks, so sharing and discovery are disabled.
- Verify the tunnel is doing its job once, using the leak test guide. A DNS leak on public Wi-Fi hands the destination list straight back to the network you were trying to hide it from.
A note on captive portals
Portals must be reached before the VPN connects, which produces the awkward sequence everyone knows: connect to Wi-Fi, accept terms, then start the tunnel. Keep that window short, do not open anything else during it, and be wary of portals asking for more than a name — some collect email and phone numbers purely for marketing, and that data is now tied to your device on that network.
Where free VPNs fail this specific test
Using a free VPN on public Wi-Fi moves your metadata from the cafe operator to an app whose revenue model you cannot see. That is not obviously an improvement — and for the class of app that resells bandwidth, it is worse. The reasoning is in are free VPNs safe. The same applies to public proxies, only more so, as covered in free proxy lists.
The honest conclusion
You are unlikely to be robbed by joining a cafe network in 2026. You will be profiled: by the venue's network vendor, by whoever runs the access point, and by anyone who set one up nearby. A VPN removes the metadata that makes that profiling possible, which is a smaller claim than the old warnings made and the accurate one.