Public Wi-Fi is not automatically a disaster, and installing a VPN does not automatically make every action safe. Modern HTTPS encrypts the connection between a browser and a website. That is a different layer from a VPN tunnel and explains why blanket “you must always use a VPN on Wi-Fi” claims are too simple.
What HTTPS does
When properly implemented, HTTPS protects the contents of the browser-to-site connection. The network can still learn some connection information, and HTTPS does not tell you whether a website’s business is trustworthy. A phishing site can also use HTTPS. Check the destination and be cautious with unexpected login pages.
What a VPN adds
A properly configured VPN may reduce what the local network operator learns about traffic routed through the tunnel. It shifts trust to the VPN operator rather than removing trust altogether. Apps, operating-system behavior and tunnel configuration determine what is actually routed. Keep software current and check the provider’s documented limitations.
Before you connect
- Confirm the correct network name with the venue.
- Keep device software and the browser updated.
- Prefer HTTPS and do not ignore certificate warnings.
- Avoid entering sensitive information into an unexpected captive-portal form.
- Use a VPN only when it fits your needs and you trust its operator.
After a captive portal
Some networks require an initial sign-in before a tunnel can connect. Once the portal is complete, confirm the VPN’s state if you intend to use it. Do not assume the app remained connected after sleep, a network change or an authentication interruption. Use the app’s documented settings rather than interpreting a single icon as a complete security assessment.
Keep account protection separate
Unique passwords, multi-factor authentication and phishing awareness remain important on any network. For a sensitive task, using a connection you control may be a better choice than trying to solve uncertainty with more software.
Read the limits of VPN protection, then evaluate provider policies and dated user experiences. We do not independently certify that a provider protects every public-network situation.