Quick answer
Public Wi-Fi is not safe by default because everyone on it shares the same network, and the person running it controls the router. HTTPS protects the contents of most web pages, but the network still sees every domain you visit, and many apps make unencrypted background requests. A VPN encrypts all of it before it leaves your phone, so the network and its operator see only one scrambled connection to one server. Connect the VPN right after you get past the sign-in page, every time.
Key facts
- Everyone on a public network shares it. Traffic that is not encrypted can be captured.
- HTTPS hides page contents, not destinations. The network still sees which sites you use.
- Fake hotspots are cheap to set up. "Free_Airport_WiFi" proves nothing about who runs it.
- A VPN encrypts everything from every app, including the background traffic HTTPS misses.
- Turn off auto-join for networks you no longer use, so your phone does not reconnect on its own.
What a shared network exposes
On your home Wi-Fi, the only other devices are yours. On a café or hotel network, the other devices belong to whoever walked in. Wi-Fi is a broadcast medium; with freely available tools, another device on the same network can capture traffic that is not encrypted, see which sites every device is talking to, and in some setups redirect connections.
The router matters too. Whoever runs the network can see every unencrypted request and every DNS lookup, and can inject content into unencrypted pages. That is true of the friendly café owner and equally true of someone who set up a hotspot with the café's name in the car park.
What HTTPS already protects
Most websites now use HTTPS, which encrypts the contents of the page between your browser and the site. That is a real protection: a password typed into an HTTPS page is not readable on the network. It leaves three gaps.
- Destinations are visible. DNS lookups and connection metadata tell the network which sites you visit, even if it cannot read the pages.
- Not everything is HTTPS. Apps make background requests, some of them unencrypted, that you never see.
- Downgrade tricks exist. A hostile network can try to steer you to an unencrypted version of a site or present a fake certificate warning that people click through.
What a VPN changes
With a VPN connected, the phone encrypts every packet from every app before it touches the Wi-Fi. The network sees one encrypted connection to one server and nothing else: no domains, no DNS lookups, no background requests, nothing to downgrade. The hostile-hotspot problem largely disappears because there is nothing readable to intercept. Our introduction to VPNs covers the mechanics; the practical point is that the shared network becomes a dumb pipe.
The rule that works: join the Wi-Fi, get through the sign-in page, connect the VPN, then open your apps. In that order, every time.
The captive portal step
Many public networks show a sign-in or accept-the-terms page first. That page has to load before the VPN can connect, because the network blocks everything else until you are through it. Do the portal, then tap connect in SecureNet. With WireGuard the handshake takes about a second, so the unprotected window is short.
Habits that go with the VPN
- Forget networks you do not use. iOS will otherwise rejoin "Cafe_WiFi" automatically anywhere a network with that name appears, including one someone set up to catch exactly that.
- Prefer cellular for anything sensitive if the VPN will not connect. Your carrier's network is not perfect, but it is not a room full of strangers.
- Keep iOS and macOS updated. Most network attacks that got past HTTPS relied on bugs that were patched.
- Watch for the connected state. SecureNet shows a clear connected indicator and runs a connection check that warns you if the internet becomes unreachable while connected. A tunnel that silently died is worse than no tunnel.
What a VPN still does not fix on public Wi-Fi
A fake login page is a fake login page whether or not you are on a VPN. Someone looking over your shoulder sees your screen regardless. And a website you sign in to still knows it is you. The VPN handles the network; the rest is on you. We keep an honest list in What a VPN protects, and what it does not.
Frequently asked questions
Is hotel Wi-Fi safer than café Wi-Fi?
Not meaningfully. Both are shared networks run by someone else. Hotel networks often have more devices on them, not fewer. Treat them the same.
Do I need a VPN if I only use apps, not a browser?
Yes. Apps make network requests just like a browser does, and you cannot see whether each one is encrypted. A VPN covers all of them at once.
Does a VPN work on networks with a sign-in page?
Yes. Complete the sign-in page first, then connect the VPN. The portal has to load before the tunnel can come up.
Is my phone safe on public Wi-Fi if I do not open anything?
Background apps still talk to the internet. If the phone is on the network, it is sending traffic. Connect the VPN or turn Wi-Fi off.