Explainer
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
You are safer on public Wi-Fi than the advertising suggests, because most sites now use HTTPS, which encrypts the page with or without a VPN. Someone on the same network will not normally be able to read your bank password.
A VPN still does something useful there: it hides which sites you reach from a network you know nothing about. It does nothing about false pages, or about your device's exposure to others on the network.
| The risk | Without a VPN | With a VPN |
|---|---|---|
| The network logs which sites you reach | Usually possible | Prevented; it sees one encrypted connection |
| Someone reads a page without HTTPS | Possible | Prevented on this network, not after the exit |
| Someone reads a page over HTTPS | Blocked by HTTPS | Blocked by HTTPS |
| A fake hotspot tampers with your connection | Possible; heed browser warnings | Much reduced while the tunnel is up |
| A false login page takes your password | Possible | Still possible |
| Another device attacks yours on the network | Possible | Often still possible; depends on the client |
Hotels and airports usually show a sign-in page before they let you online. A VPN cannot connect until you have passed it, and that page cannot load while a kill switch blocks everything. So there is often a short period when your device is on the network without the tunnel, and your apps may use that time to send traffic.
Keep that moment short: sign in, connect the VPN, then carry on. Be careful what you enter on a sign-in page, since it is served by a network you know nothing about. It has no reason to ask for an email password.
Mobile data is also often a good alternative, as it takes the shared network out of the picture.
If you regularly use networks you do not control, and you would prefer that their operators not see which sites you visit, a VPN does that well. That is a smaller and more honest promise than protection from hackers, and what a VPN does not protect you from sets out the rest.
Keep in mind that the view does not vanish. It moves from the cafe's network to the VPN provider, so who runs the VPN still matters.
Generally yes, if the page is your bank's real site over HTTPS and your browser shows no warning. The network cannot read that traffic. Never click through a certificate warning, and consider using your banking app or mobile data if you want extra margin.
Often you cannot, since anyone can give a network a familiar name. Ask staff for the exact name, and avoid connecting automatically to networks you have used before. Treat any network as untrusted, and check the address of any page before signing in.
The login page is on the local network and the VPN is sending traffic away from it. You may need to sign in to the network first and then connect, and a kill switch may need relaxing for that moment.
Next
Every explainer ends by naming the pages that own what it only touched.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.