Is hotel and airport Wi-Fi safe?

Why hotel and airport Wi-Fi carry the same risk

A hotel network is effectively a small ISP run as an afterthought by whichever company maintains the property's IT, shared by every guest who has ever typed in a room number. An airport network is the same idea at a much larger scale: one SSID serving thousands of strangers passing through a single building for a few hours at a time. Neither is run by a team whose job is your security, and neither gets the kind of attention a bank or a well-run office network does.

The specific failure modes differ slightly. Hotels tend to under-invest in the basics: firmware that has not been updated in years, and client isolation, the setting that stops one guest's laptop talking to another's, frequently switched off or never configured. Airports face a different problem: because the terminal is open to the public and thousands of people are hunting for a network named something like "Airport_Free_WiFi" or "Terminal_Guest", it is trivially easy for anyone with a laptop and a cheap wireless adapter to broadcast a fake hotspot with a near-identical name. This is called an evil twin attack, and it works because travellers rarely check who actually owns the access point before connecting.

In both settings, the password on a key card, a boarding pass, or a login portal controls entry to the network. It says nothing about who else is on that network, how it is configured, or whether the access point you joined is even the real one.

What a VPN actually protects

Once connected, a VPN wraps everything your device sends into an encrypted tunnel before it ever touches the local Wi-Fi or the hotel's or airport's router. That closes off the specific things a shared network makes easy for other people on it:

• Other guests or passengers on the same network cannot read your traffic by sniffing the wireless signal, since it is encrypted before it leaves your device.
• The hotel or airport operator cannot see which sites and services you use, only that you are connected to a VPN server.
• Someone running an evil twin hotspot cannot read or tamper with your traffic even if you have joined their fake network by mistake, because the VPN tunnel still only trusts the VPN server at the other end.
• DNS hijacking, where a malicious router quietly redirects your lookups for a legitimate site to a fake one, is defeated because DNS requests travel inside the encrypted tunnel instead of going straight to the local router.

This is genuinely the main threat on hotel and airport Wi-Fi, and it is also the one a VPN handles cleanly. If your biggest worry is "can the person two tables away, or whoever runs this network, see or interfere with what I am doing," a VPN answers that directly.

What a VPN does not protect against

This is the part most VPN marketing skips, and it matters more than the part above. A VPN secures the journey your data takes across the network. It has no influence over what happens before that journey starts or after it ends, which rules out several things people assume it covers.

• Phishing. If an email or a fake captive portal convinces you to type your password into a page that looks genuine, a VPN does nothing: you have handed your credentials over voluntarily, encrypted channel or not.
• Malware. If you download and run a malicious file, or a captive portal page itself tries to install something before you have even connected your VPN, encryption on the network does not stop the software from running on your device.
• Sites that store your data badly. A VPN protects data in transit between your device and the VPN server. It cannot protect data once it has arrived at a website you logged into, especially one still served over plain HTTP, that then stores it insecurely, sells it, or loses it in a breach. That is the site's responsibility, not the network's, and a VPN has no reach over it.
• A device that is already compromised. If spyware or a keylogger is already running on your laptop or phone before you connect to any Wi-Fi, the VPN tunnel still carries that stolen data out faithfully, just encrypted.
• The moment before the VPN connects. Most apps need to complete a captive portal login, the "accept terms and connect" page hotels and airports use, before the VPN tunnel is active. Whatever happens on that first exchange with the portal happens outside the tunnel.

None of this is a reason to skip a VPN on hotel or airport Wi-Fi. It is a reason to treat the VPN as one layer, not the whole defence.

A practical checklist for connecting safely

• Confirm the exact network name with a member of staff rather than guessing, since fake networks often use a name that is one character off from the real one.
• Be suspicious of more than one network with a plausible-sounding name in the same list; pick the one staff confirmed, not the strongest signal.
• Give the captive portal page the minimum it asks for. A room number and surname is a data collection form, not a security check, and typing in more than required gains you nothing.
• Connect your VPN as soon as you are through the portal, before opening email, banking, or any account that matters.
• Turn off file sharing, AirDrop, and network discovery, and mark the connection as a public network so your device stops advertising shared folders to everyone else on it.
• Keep your operating system and browser updated before you travel; patches close the vulnerabilities that make an unprotected device easy to attack on any shared network.
• Use a password manager rather than typing credentials manually on a borrowed screen or airport kiosk, which cuts your exposure to shoulder surfing and some phishing pages that only work against manual typing.
• Avoid logging into anything sensitive on a public computer or airport business-lounge terminal altogether; a VPN on your own device cannot help you on hardware you do not control.
• Check for the padlock and a correct domain name in the address bar regardless of whether your VPN is on. HTTPS and a VPN protect different things, and you still want both.