Public Wi-Fi in cafés, airports and hotels: what the network owner sees and when you need a VPN

In short: almost nobody in a café can read your passwords or chats: HTTPS protects them, and messengers encrypt messages themselves. But the hotspot owner sees which sites you visit, and some networks also know your phone number. Here is what is a real risk on an open network, what a VPN closes, and how to connect without falling for a fake network.

What the network owner sees

• Where you connect. Server addresses, times and amounts of data are always visible.
• Site names. DNS queries give them away if your device uses the network's DNS, and so does the site name at the start of almost every HTTPS connection (the SNI field). Encrypted Client Hello hides that name, but it is still rare.
• The content of HTTPS pages: no. Passwords, email, forms and messenger chats are not visible to the network owner. Pages without HTTPS are visible and can be altered, but very few are left.
• Your device. Its hardware Wi-Fi address (MAC) unless the system hides it, and a Windows PC usually tells the network its name too.

Your home internet provider sees almost the same; details in what your ISP sees. The difference is that a café or hotel has no contract with you, and anyone can put up a network with the same name.

Why some networks ask for your phone number

Some networks ask for a phone number or an email just for marketing. In some countries it is the law. In Russia, for example, government decrees No. 758 and No. 801 have banned anonymous access to public Wi-Fi since 2014: the user must be identified by a code sent by text message, a Gosuslugi (state services) account or an ID document.

Either way, the result is the same: the hotspot operator can link your number to everything visible on the network, that is, addresses, times and site names. With a VPN on, all that remains behind the number is one connection to a VPN server and its volume. The fact that you use a VPN is still visible.

Which risks are real

• Evil twin networks. A hotspot with the café's name or a similar one, for example with _Free added. Your phone joins a familiar name by itself if the network is saved and open.
• A sign-in page that asks for too much. A phone number, a room number or a code by text message is normal. Your email or social media password, card details or an app to install "for access" are signs of a fake network.
• Certificate warnings. If, after you have joined the network, the browser says the connection to an ordinary site is not private, do not continue. It means someone stands between you and the site.
• Other people on the network. Shared folders, Windows network discovery, AirDrop for everyone: in a hotel you share a network with the other guests.
• Old apps without encryption. Rare, but they exist: whatever they send is visible and can be altered.

What a VPN closes and what it does not

The reverse matters too: with a VPN, the site names are seen by the VPN server instead of the café. So pick a service you trust; what we keep is in our privacy policy. Free services often make money from exactly this data, see how free VPNs resell your bandwidth.

How to connect, step by step

1. 1Check the network name with the staff or on a sign. Do not pick a network by signal strength: a twin is often closer and louder than the real one.
2. 2Go through the sign-in page. Until you sign in, the network lets through only that page, so the VPN cannot connect. If the page does not open and your VPN has a kill switch on, turn the VPN off while you sign in. If the page does not appear by itself, open any address that starts with http:// in the browser.
3. 3Enter only what signing in needs: a phone number, a code by text message, a room number. Use a sign-in through another service only if the browser's address really belongs to that service.
4. 4Right after signing in, turn on the VPN and open our leak test: it should show the VPN server's address, not the hotspot's.
5. 5Close sharing. When Windows asks about the network type, choose public. On a Mac, turn off file sharing; on iPhone and Mac, set AirDrop to Contacts Only.
6. 6When you are done, tap Forget This Network. A saved open network name lets your phone join a twin somewhere else.

Settings that always help

• Private Wi-Fi Address on iPhone and iPad. Settings → Wi-Fi → ⓘ next to the network. It is on by default since iOS 14, and from iOS 18 the address also rotates on open networks and networks with a sign-in page. Turn it off only for a network where signing in fails without that. More in MAC address randomization.
• Randomized MAC on Android. On by default for each network since Android 10; you can check it in the network's details.
• Auto-join for open networks. Turn it off and delete networks you no longer use.
• System and browser updates. Fixes to certificate checks only come with them.
• Your own mobile data. For banking and important things, a hotspot from your phone is safer than someone else's Wi-Fi.

Our ProxysVPN app is available for iPhone and iPad, Android and Mac. If someone else's resolver still answers with the VPN on, see DNS leaks explained. A separate guide for crypto wallet holders: seed phrases and public Wi-Fi.

Frequently asked questions