The Real Risks of Public WiFi
Public WiFi risks are often overstated in marketing, but some are real. The two main threats are network sniffing on unencrypted connections and evil twin attacks, where someone sets up a hotspot with the same name as the legitimate network to intercept traffic. Modern HTTPS connections encrypt the content of your communications, but metadata (which sites you visit, when) can still be visible to network operators. A VPN encrypts all of this at the network level.
When a VPN Matters Most on Public WiFi
A VPN provides the most meaningful protection when you are using apps or services that do not use HTTPS, when you are logging into sensitive accounts in unfamiliar environments, or when you are on a network you did not explicitly choose to trust (hotel WiFi, airport WiFi, conference center networks). For casual browsing on modern HTTPS websites, the actual security difference is smaller than it used to be, but the privacy benefit (hiding your browsing from the network operator) remains.
Recommended Setup for Travelers
NordVPN and ExpressVPN both have mobile apps with automatic WiFi protection: the VPN activates automatically whenever you connect to any network that is not your saved home or office network. This is the best configuration for frequent travelers because it requires no conscious action. Set it up once and forget it.
Speed on Public Networks
Airport and hotel WiFi is often slow to begin with. A VPN adds 10 to 20 percent overhead, which on a 5 Mbps hotel connection means you drop from 5 to 4 Mbps. Not ideal but workable for email and video calls. If you are doing large file transfers, consider whether the VPN is worth the extra latency for that specific task.
Hotel WiFi Portals
Hotel WiFi often requires you to log in through a captive portal before you can access the internet. You need to connect to the network, load the portal page, log in, and then connect your VPN. Most VPN apps handle this automatically by detecting that the portal needs to be dismissed before the VPN can activate. If yours does not, temporarily disconnect the VPN, log in to the portal, and then reconnect.