Wi-Fi security · Plain-English answer
Mostly, yes, in the sense that matters most: your bank's HTTPS connection encrypts your login, balance and transactions the same way it does at home, so hotel Wi-Fi does not hand your password to anyone casually watching the network. What it does not hide is which bank you use, your DNS lookups, or whether the network itself has been tampered with, and that gap is what a VPN closes. Neither HTTPS nor a VPN does anything about phishing, a bank app with its own flaws, or a device that is already compromised.
Every mainstream bank forces HTTPS on its website and apps, which means the entire content of your session, your password as you type it, your account numbers, your balance, and any transfer you authorise, is encrypted between your device and the bank's servers. This is strong, well-tested cryptography. A hotel network operator, another guest on the same Wi-Fi, or someone running packet-capture software in the lobby cannot read any of that traffic, whether you are at home or three time zones away. This part of the picture has not changed in years, and it is the main reason online banking abroad is far safer than its reputation suggests.
What HTTPS does not hide is the metadata around that encrypted session. The server name you are connecting to is visible in the TLS handshake unless the network specifically supports encrypting it, so a hotel router can typically tell that you connected to your bank's domain, even though it cannot see what you did there. Before that handshake even happens, your device usually asks the hotel's own DNS resolver to look up the bank's address in plain text, which reveals the same thing a step earlier and a little more clearly, since DNS queries are rarely encrypted on a hotel network by default. A captive portal, the login page hotels use before granting internet access, sits in front of all of this and can redirect or inspect unencrypted traffic, though it cannot read inside an HTTPS session once it is running. An evil-twin hotspot, a fake access point broadcasting a name copied from the real one, controls DNS entirely and can try to steer you toward a convincing fake login page, hoping you do not notice a mismatched address or a missing padlock. Mobile banking apps that use certificate pinning, where the app refuses to trust any certificate except the bank's own even if the device's wider trust store has been tricked, close off one more version of that trick that a browser visiting the bank's website in a tab does not automatically get.
A VPN wraps everything your device sends into one encrypted tunnel to a server you choose, before any of it reaches the hotel's router. On a shared network that changes the picture in a few concrete ways. The hotel or airport operator, and anyone else on the same Wi-Fi, no longer sees which bank's domain you are contacting, only that you are connected to a VPN server. Your DNS lookups travel inside that same tunnel instead of going to the hotel's resolver in plain text, so the quiet way of noting "the guest in room 412 banks with a particular provider" disappears. An evil-twin hotspot loses most of its leverage too: even if you connect to a fake access point by mistake, the VPN tunnel is authenticated against your real VPN server, not the local network, so a fake hotspot operator cannot read your traffic or swap in a different certificate to intercept it.
None of this duplicates what a VPN does on hotel or airport Wi-Fi generally, since the risks of a shared, badly managed network are the same whether you are checking a bank balance or reading email. For the wider picture of what those networks get wrong and how to connect to them safely, see is hotel and airport Wi-Fi safe; what changes here is specifically what is at stake when the site in question is your bank, and what the VPN still leaves for you to handle yourself before and after that handshake, such as the captive portal step itself, which usually has to be completed before the VPN tunnel can start.
This is the part worth being honest about, because it is easy to treat a VPN as a complete answer to online safety when it only ever secures the network journey, not what happens at either end of it.
None of this is a reason to skip the VPN on hotel Wi-Fi. It is a reason to treat it as the layer that closes the network gap, alongside habits that cover what it cannot reach.
ROOT VPN is free to start with unlimited data, no card needed, and no activity logs.
Get ROOT VPN, free