Public WiFi at airports, hotels, and cafes is one of the most cited reasons to use a VPN. Here is what the actual risks are, what a VPN actually protects against, and what it does not.
The Actual Risk on Public WiFi
The most common attack on public WiFi is the man-in-the-middle attack, where an attacker positions their device between you and the router to intercept traffic. In 2026, this is much less effective against HTTPS traffic than it was in 2015 -- most websites and apps use TLS encryption, and the attacker sees encrypted data, not readable content. The more realistic risks are rogue access points (a fake WiFi network with a convincing name like 'Airport_Free_WiFi') and DNS hijacking (the router redirecting your DNS queries to malicious servers).
What a VPN Protects Against on Public WiFi
A VPN encrypts all traffic from your device to the VPN server, which means even if you are on a rogue access point, the attacker sees only encrypted tunnel traffic. It also overrides the network's DNS with the VPN provider's DNS, preventing DNS hijacking. For non-HTTPS traffic (rare in 2026 but still exists with some older apps), a VPN provides meaningful protection.
What a VPN Does Not Protect Against
Phishing attacks: if you click a link and enter your credentials on a fake site, the VPN does not help. Malware already on your device. Attacks on the VPN server itself (your traffic is exposed at the VPN exit point). Legal requests to the VPN provider for your activity logs (which is why no-logs policies matter).
Best VPNs for Public WiFi
ExpressVPN and NordVPN automatically connect on untrusted networks via their trusted network feature (configurable in the app). ProtonVPN has a stealth mode that makes VPN traffic harder to block on networks that restrict VPN protocols. For the most security-focused: Mullvad has no account required and accepts cash payments -- maximum anonymity.