"Use a VPN on public WiFi" is advice you've probably heard a dozen times without anyone explaining what actually goes wrong if you don't. Here's the plain version — what's actually happening on that hotel or airport network, and why it matters.
What "public" actually means for a WiFi network
A home WiFi network has one household on it, usually with a unique password nobody outside the home knows. A public network — airport, hotel lobby, hostel common room, cafe — has dozens or hundreds of strangers connected to the same access point, often with a password anyone can get simply by asking staff or reading a receipt.
That shared access is the entire problem. Being on the same network as someone doesn't just mean you're both using the same internet connection — depending on how the network is configured, it can mean your devices are visible to each other in ways that would never happen at home.
What a man-in-the-middle attack actually is
The most common risk on public WiFi has a name: a man-in-the-middle (MITM) attack. It works roughly like this — someone on the same network positions themselves between your device and whatever you're connecting to, whether that's your bank's app or a hotel booking site. Your data still seems to arrive at its destination, but it passes through that third party first, who can read it, and in some cases alter it, without either side noticing anything unusual.
This isn't a theoretical scenario reserved for high-value targets. The tools to attempt this on an open network are widely available and don't require deep technical skill, which is exactly why security guidance treats any public network as untrusted by default.
Three moments where this actually matters
- Logging into anything. Banking apps, email, and social accounts all send credentials that are worth intercepting.
- Entering payment details. Booking a hostel or bus ticket from cafe WiFi means typing a card number on a network you don't control.
- Anything you'd consider private. Messages, photos, and location data are all technically interceptable on an unsecured connection, not just financial data.
What a VPN actually changes here
A VPN encrypts your traffic before it leaves your device, so even if someone is positioned to intercept it on the same network, what they capture is unreadable without the encryption key. It doesn't make the network itself more trustworthy — it makes what happens on it irrelevant to anyone trying to listen in.
This is the specific, practical reason "use a VPN on public WiFi" is common advice rather than just caution for its own sake. For a setup built specifically around this kind of use, see our guide to the best VPN for airport and hotel WiFi.
Does a password make a network safe?
Not meaningfully. A shared password — like one printed on a hostel receipt — controls who can join the network, but everyone who does join is still on the same shared network together. It reduces the pool of possible strangers, not the underlying risk between the people already on it.
Frequently asked questions
Is public WiFi safe if it requires a password?
A shared password still means everyone on that network has the same access — it restricts who can join, but doesn't meaningfully protect your traffic from others already connected.
What is a man-in-the-middle attack?
It's when someone positions themselves between your device and the site or service you're accessing, allowing them to intercept or alter the data passing between the two, often without either side noticing.