"Never use public Wi-Fi without a VPN or hackers will steal your bank password" is one of the most repeated pieces of internet safety advice, and it's also mostly outdated. That doesn't mean public Wi-Fi is risk-free — it isn't — but the actual threat model in 2026 looks pretty different from the one that advice was written for a decade ago, mostly because of one enormous change: almost everything is HTTPS now.
Why the old warning was true, and why it's weaker today
The classic public Wi-Fi horror story is packet sniffing: someone else on the same network runs software that captures traffic passing over the shared wireless medium, and if that traffic is unencrypted, they can read it directly — including passwords typed into plain HTTP login forms. That attack was genuinely easy and genuinely common in the mid-2010s, because a meaningful share of the web still used plain HTTP.
Today, the vast majority of real websites — certainly anything handling a password, a payment, or anything sensitive — use HTTPS by default, and browsers actively warn you (or refuse to load the page at all) when a site doesn't. HTTPS encrypts the connection between your device and that specific website end-to-end, which means someone sniffing packets on the same coffee-shop Wi-Fi sees encrypted gibberish, the same as they would if you were on a VPN. For that specific threat — a passive eavesdropper reading your traffic content — HTTPS alone already does the job for the sites that matter most.
What's still genuinely risky on public Wi-Fi
None of that means public Wi-Fi is fully safe, though. A few real risks HTTPS doesn't cover:
- Metadata is still visible. Even with HTTPS, anyone on the same network can typically see which domains you're connecting to (via DNS lookups and the TLS handshake's SNI field), just not the content. That's a real privacy leak even if it's not a password theft.
- Rogue and spoofed access points. An attacker can set up a Wi-Fi network named to look like the venue's legitimate one ("Airport_Free_WiFi") and get you to connect directly to them. From there they control DNS resolution and can attempt to intercept or redirect traffic, present fake certificate warnings hoping you'll click through, or simply see far more of your unencrypted metadata than they would on a legitimate shared network.
- Unpatched or misconfigured devices and apps. Some apps and IoT-style devices still make plain HTTP requests, or use certificate validation incorrectly, which reopens the packet-sniffing attack for that specific traffic even on an otherwise HTTPS-heavy internet.
- Local network exposure. Public Wi-Fi sometimes puts your device on the same local network segment as strangers' devices, which matters if your device has file sharing, remote access, or other local-network services enabled and discoverable.
What a VPN actually adds here
Given that picture, a VPN's real contribution on public Wi-Fi is narrower — and more honest — than "protects you from hackers": it encrypts everything leaving your device, not just the HTTPS-covered parts, which closes the metadata leak (what domains you're visiting), covers any stray unencrypted app traffic, and makes a rogue access point far less useful to an attacker, since even a network they fully control just sees an opaque tunnel to your VPN server instead of your real destinations. It also sidesteps DNS-level snooping and tampering, since your DNS lookups travel through the encrypted tunnel too rather than going to whatever resolver the local network hands you.
What it doesn't do is patch a genuinely malicious access point's ability to see that you're connected at all, protect you if you get socially engineered into installing something or approving a fake certificate, or replace basic hygiene like keeping your device's software updated and turning off file sharing on networks you don't trust.
A few other things worth knowing
"Man-in-the-middle" is the general term for an attacker positioning themselves between you and whatever you're trying to reach, and it's worth knowing that HTTPS's certificate system is specifically designed to make that hard to pull off silently — a genuine man-in-the-middle attack against a properly validated HTTPS connection generally requires either a compromised certificate authority (rare, and usually caught quickly when it happens) or getting you to click through a browser warning you shouldn't. That's a meaningfully higher bar than the old "just sniff the unencrypted packets" attack, which is part of why the threat model has shifted rather than disappeared.
It's also worth separating "public" from "untrusted." A well-run venue's Wi-Fi, with proper client isolation (a setting that prevents devices on the same network from seeing each other's traffic at all), is a meaningfully different risk than an open network with no isolation where anyone can run packet-capture software freely. Most people have no easy way to tell which kind of network they're on from the connection screen alone, which is part of why treating all public Wi-Fi with a consistent baseline of caution — rather than trying to judge each network individually — tends to be the more practical approach.
So — is it worth using a VPN on public Wi-Fi?
Yes, but for calibrated reasons rather than fear. If you're doing something on public Wi-Fi where you'd rather the network operator or other people sharing it not see which sites and services you're using — which, depending on what "public" means in your case, might just be "everyone in this airport lounge" — a VPN closes that gap cleanly, and does so for essentially your entire connection instead of site-by-site. If you're purely browsing HTTPS sites you don't care about keeping private from a curious stranger on the same network, the marginal safety benefit is smaller than the old advice implies, though the metadata privacy benefit is still real.
The strongest version of the advice isn't "public Wi-Fi will get you hacked" — it's "public Wi-Fi gives up privacy you might not realize you're giving up, in ways a VPN closes without you having to think about which specific site or app is the risky one."