What a VPN Actually Changes on Public Wi-Fi
On public Wi-Fi, a VPN hides which sites and services you connect to from the network operator and anyone else on that network. It does not stop your passwords being stolen, because in almost every case they were never exposed in the first place. The gap a VPN closes on an untrusted network is real, but it is a metadata gap, not the dramatic one the advertising describes.
Understanding that difference is the whole point, because it tells you when switching a VPN on genuinely changes your position and when it is theatre.
What the network can see without a VPN
When you join someone else’s Wi-Fi, the operator of that network — the café, the hotel, the airport, whoever configured the router — sits between you and the internet. Every packet passes through them. What they can learn from that position falls into two very different categories.
They can see where your traffic is going. The destination address of each connection is unencrypted by necessity: routers need it to deliver the packet. The name you looked up before connecting is often visible too, because DNS queries have historically travelled in the clear. Add the timing and size of those connections and a network operator can build a decent list of the services you used and roughly when.
They generally cannot see what you sent. Web traffic is encrypted in transit by default now. Browsers mark unencrypted pages as insecure, apps refuse plain connections, and the practical result is that the contents of your session — the form you filled in, the message you typed, the password you submitted — are already protected between your device and the server before any VPN is involved.
That second point is the one the marketing quietly depends on you not knowing.
Where the “hacker on the coffee shop Wi-Fi” story came from
It was true, and then it stopped being true, and the story outlived the conditions that produced it.
A decade and a half ago, a large share of the web ran unencrypted. Session cookies for major sites travelled in plain text over shared wireless. Tools existed that let anyone on the same network scoop up those cookies and log in as you with a couple of clicks. Public Wi-Fi really was a live danger for ordinary accounts.
What changed was the near-universal adoption of transport encryption, driven by browser vendors making it the default and treating its absence as an error state. The attack the story describes now fails against a correctly configured site, because there is nothing readable to intercept.
What is left is a narrower problem, and it is the problem a VPN on public Wi-Fi actually solves.
The gap that remains, and how a VPN closes it
Destination visibility. The network operator still learns the list of services you touched. For many people that is uninteresting; for some it is genuinely sensitive — a health service, a legal service, a support organisation, an employer’s system that reveals where you work.
Captive portals and injected content. Networks that intercept traffic to show a login page, insert advertising, or downgrade connections have a foothold that a tunnel removes.
Devices and apps that are less careful than your browser. Not everything running on your phone follows modern practice. Some older applications, some embedded software, and some background services still make unencrypted requests you never see.
A VPN addresses all three at once, for the same structural reason: your device builds one encrypted connection to a server elsewhere and sends everything through it. The local network sees an encrypted stream to a single address and nothing more — not the destinations, not the DNS lookups, not the contents. That is a real improvement in a real situation, described accurately.
What it does not fix
Anything that identifies you at the application layer. If you sign into an account over the tunnel, the service knows exactly who you are. The network operator’s ignorance does not propagate to the far end.
A compromised device. If something malicious is running on your laptop, the tunnel carries its traffic faithfully. See device-side threats for why the tunnel’s starting point matters more than its route.
A hostile network doing something other than watching. A network that tampers with DNS before your VPN connects, or blocks the VPN outright, changes what you can do rather than what it can see. Some clients handle that badly.
Leaks in your own setup. A connected VPN that is quietly sending DNS queries outside the tunnel gives the local network exactly the information you switched it on to hide. That failure mode is common enough to deserve its own treatment in VPN leaks and kill switches.
Whether to use one anyway
Yes, mostly — but for the accurate reason rather than the advertised one.
Public Wi-Fi is the clearest case where a VPN improves your position, because the observer you are removing is one you have no relationship with, no way to assess, and no reason to trust. Swapping the visibility of a hotel’s network contractor for the visibility of a VPN provider you chose deliberately is a trade most people should be happy with. That is the trust relocation this site keeps returning to, and on an untrusted network it points clearly in one direction. It points much less clearly at home.
Practical notes that matter more than the choice of provider:
- Turn it on before you use the network, not after. The first few seconds of an unprotected connection are when DNS lookups and background sync happen.
- Prefer your phone’s mobile connection for anything genuinely sensitive on a network you distrust, if you have the data available. A tunnel is a good answer; not using the hostile network at all is a better one.
- Do not let the VPN talk you out of the basics. A password manager and multi-factor authentication protect your accounts on every network, including the ones you trust. A VPN protects none of them.
- Check that the tunnel actually carries everything once, properly, rather than assuming the connected icon means what it implies.
If you want the underlying mechanism rather than the threat picture, how a VPN works covers the tunnel itself, and what a VPN protects against sets out the full scope in one place.