On this page
What can actually go wrong
On an open network, everyone connected shares the same airwaves, and the owner of the hotspot, or anyone who set up a fake one, sits between you and the internet. That position allows a handful of attacks.
- Fake hotspots, also called evil twins. Someone creates a network named Airport Free WiFi or copies the name of the cafe's real network. Your device may join it by itself if it has joined a network with that name before.
- Snooping on unencrypted traffic. Anything sent without encryption, such as old apps, plain HTTP pages or some smart devices, can be read by whoever controls the hotspot.
- DNS tampering. A malicious hotspot can answer your device's DNS lookups with addresses of its own choosing and send you to a copy of a login page.
- Fake sign-in pages. The page a hotel or airport shows before you get online can be faked, and a fake one may ask for card details, your email password or an app install.
- Attacks on your device. Open file sharing, unpatched software and devices that accept connections from the local network are exposed to everyone on the same Wi-Fi.
- Tracking. Even when content is encrypted, the network sees which sites you connect to and when, and some free hotspots log it for analytics or marketing.
What HTTPS already protects, and what it does not
When your browser shows a secure connection, the content of the page, your passwords and your card numbers are encrypted between your browser and the website. A hotspot owner can neither read nor change them. This is the main reason public Wi-Fi is safer today than it used to be.
HTTPS leaves some things exposed, and a VPN does not fix everything either:
| What is at stake | Without a VPN | With a VPN |
|---|---|---|
| Page content, passwords and card numbers on HTTPS sites | Encrypted by HTTPS | Encrypted by HTTPS, inside the encrypted tunnel |
| Which sites you visit | Usually visible to the hotspot through DNS lookups and connection details | Hidden from the hotspot; the VPN server handles them instead |
| Apps and devices that do not encrypt their traffic | Readable by the hotspot | Encrypted inside the tunnel |
| Your device on the local network (sharing, open ports) | Exposed to other users | Still exposed: a VPN is not a firewall for your device |
| A fake login page you type your password into | Not protected | Not protected |
The last two rows matter. A VPN encrypts traffic leaving your device, but it does not make you immune to phishing or to attacks on a device that accepts incoming connections. You still need the habits below.
Before you connect
- Confirm the network name with staff or on a printed sign. Be wary of near-duplicates with an extra word such as Free or Guest, and of an open network when the real one has a password.
- Prefer networks with a password. With WPA3, other guests cannot decrypt your traffic even though they know the password. With older WPA2, a determined guest who knows the password can. Either way, a password stops casual snooping, but it does not stop a fake copy of the network.
- Turn off auto-join for public networks. Tell your phone or laptop to forget a hotspot when you leave, so it does not silently join a network with the same name somewhere else.
- Mark the network as public. On Windows, choose Public network when asked; it turns off network discovery and file sharing on that network. On a Mac, switch on the firewall in System Settings.
- Update first. Install pending system and browser updates at home. Many attacks on local networks rely on old, already fixed bugs.
Captive portals and when to switch the VPN on
Hotels, airports and trains often show a sign-in page before they let you online. This page is called a captive portal, and it clashes with VPNs: the VPN cannot connect until you have signed in, and the portal cannot load while a kill switch blocks traffic outside the tunnel.
- Join the Wi-Fi with the VPN off, or with the kill switch paused for a moment.
- Let the sign-in page appear. If it does not, open a plain site such as
neverssl.com, which exists to trigger portals. - Check the page before you type anything. It should ask for a room number, a voucher or an email address. It should never ask for your email password, and it should ask for a card only when you knowingly pay for access.
- Once you are online, switch the VPN on and turn the kill switch back on.
Some hotel, train and conference networks only let web traffic through and block the ports VPNs normally use, often by accident rather than by policy. If WireGuard will not connect after the portal, try OpenVPN over TCP port 8080, which BoltVeil calls firewall mode. If the network's terms say that VPNs are not allowed, respect them and use mobile data instead.
Where a VPN helps on public Wi-Fi
A VPN creates an encrypted tunnel from your device to a VPN server. On public Wi-Fi that has three concrete benefits: the hotspot cannot see which sites you visit, it cannot read traffic from apps that skip encryption, and it cannot tamper with your DNS lookups, because those travel through the tunnel too.
For that to work, the VPN has to be on before anything sensitive happens, and it has to stay on. Use the platform kill switch where there is one (our WireGuard setup guide shows where), and set your phone to start the VPN automatically on Wi-Fi you do not trust.
BoltVeil works with the free VPNClient app and the official WireGuard and OpenVPN apps on every major platform. Plans start at $4.99 a month on the pricing page, or you can earn premium days without paying, as explained on the free VPN page.
Habits that matter more than any tool
- Use two-factor authentication on email, banking and social accounts. A stolen password is far less useful without the second factor.
- Take certificate warnings seriously. If your browser warns that a connection to a well-known site is not private, stop. On public Wi-Fi that warning can mean someone is intercepting the connection.
- Never install anything a hotspot asks for. No cafe, hotel or airport hotspot needs you to install an app, a certificate or a profile to get online.
- Keep banking for mobile data if you are not using a VPN. Your carrier's connection is much harder to impersonate than a Wi-Fi name.
- Log out and forget the network when you leave, especially on shared or borrowed computers.
- Limit what you share nearby. Turn off Bluetooth when you do not need it, and on iPhone set AirDrop to Receiving Off or Contacts Only.
A quick checklist
- Network name confirmed with staff.
- Network marked as public, sharing off.
- Signed in to the portal, then VPN on with the kill switch.
- A secure connection on every page where you type something.
- Network forgotten when you leave.