Is Public WiFi Safe? Hotel, Airport, and Café WiFi Explained

Last updated: October 2026

This guide covers the public WiFi you meet while traveling: hotel and short-term rental networks, airport and airline lounge networks, and café networks. It explains what still goes wrong on them, the device settings that prevent most of it, and how a travel router handles the hotel problems a VPN cannot. The four travel routers named here are the TP-Link Roam 7 BE3600, TP-Link Roam 6 AX1500, GL.iNet Beryl AX, and GL.iNet Beryl 7.

Key Takeaways

• Public WiFi is usually safe for browsing, email, banking apps, and streaming because almost every site and app encrypts its traffic with HTTPS. The Federal Trade Commission's current consumer guidance says the same.
• The risks that remain happen before encryption starts: a fake network copying the venue's name (an evil twin), a fake login page in front of it, and other devices on the same network reaching yours. Confirming the network name and turning off auto-join stop most of it.
• A VPN hides where you go but cannot get a streaming stick past a hotel login page or share one login across six devices. A travel router does both and runs the VPN for every device at once.

Is public WiFi safe?

Yes, for ordinary use, as long as you are on the network you think you are on. The padlock in your browser means the connection between your device and that website is encrypted end to end, so the hotel, the café, and anyone else on the network can see which sites you contact but not what you do there. Banking, email, and messaging apps encrypt the same way. The FTC's page Are Public Wi-Fi Networks Safe? opens by saying things have changed since the early days of the internet and that, because encryption is now so widespread, connecting through a public network is usually safe.

That "yes" has three conditions. The network has to be the venue's, not a copy. You cannot type anything into a page that appeared before you were online unless you are sure it belongs to the venue. And your device has to be set so that other devices on the same network cannot reach it. Public WiFi goes wrong when one of those breaks, and all three are things you control.

What can go wrong on public WiFi?

Four things account for nearly every public WiFi problem travelers run into. Two of them are attacks; two are not.

What is an evil twin network?

An evil twin is a second WiFi network broadcasting the same name as the legitimate one: "Hilton_Guest," "DEN Free WiFi," the café's name. Your phone cannot tell the two apart. Phones also remember open networks by name alone, so a phone that joined "Airport Free WiFi" in Denver will auto-join anything called "Airport Free WiFi" in Phoenix without asking. Once you are on the copy, everything you do passes through the attacker's hardware. Encrypted traffic stays encrypted, but the attacker controls the login page, the DNS answers, and every unencrypted request your apps make in the background.

What is a captive portal, and how is it faked?

A captive portal is the login page a hotel or airport shows before it lets your device onto the internet. Because it loads before you are online, your browser's usual protections are at their weakest there. A fake portal on an evil twin can ask for your room number and last name, an email and password, or a credit card for "premium" access, and it looks exactly like the venue's page. The most dangerous version asks you to install a certificate, a configuration profile, or an app to continue. A legitimate hotel portal never requires you to install anything.

Can other devices on public WiFi reach mine?

Yes, unless your device or the venue blocks it. At home, your laptop trusts the devices around it; that is how AirDrop, printer sharing, and file sharing work. On a public network with two hundred strangers, the same features are an open door. This is why Windows asks whether a new network is public or private, and why macOS and iOS let you limit AirDrop to contacts only. Well-run hotels and airports isolate each guest's device from the others. Many smaller venues do not.

What does the venue collect?

The email a portal asks for is collected for marketing, and the network operator can see every domain your device contacts even when it cannot see the contents. That is not an attack, but it is why your phone should not announce its permanent hardware address to every network it joins (the private address setting below handles this) and why you should forget the network when you leave.

What should I check before connecting to public WiFi?

Confirm the network name with staff, turn off auto-join, and keep sharing off. Those three steps stop evil twins, fake portals, and device-to-device access. The rest of this list takes a minute the first time and is automatic after that.

• Get the exact network name from staff. "Marriott_Guest" and "Marriott Guest" are two different networks, and only one belongs to the hotel.
• Turn off auto-join for public networks. On iPhone, tap the network name and switch off Auto-Join. On Android, open the network's settings and turn off auto-connect. Your phone will then never join an evil twin on its own while it sits in your pocket.
• Leave the private address setting on. iPhones since iOS 14 and Android phones since Android 10 use a different, made-up hardware address for each network by default, so a venue cannot recognize your phone from one visit to the next. iOS 18 and later add a Rotating option that changes the address every two weeks. Apple's private Wi-Fi address support page covers the three settings.
• Tell your laptop the network is public. On Windows, choose Public when the prompt appears, or change it later in the network's properties; that one choice hides your computer from everything else on the network. On a Mac, turn off File Sharing and Screen Sharing in System Settings, and set AirDrop to Contacts Only or Receiving Off.
• Turn on HTTPS-only mode in your browser. Chrome, Edge, Firefox, and Safari each have a setting that refuses to load an unencrypted page without warning you first, so a tampered network cannot downgrade you to an unencrypted copy of a site.
• Use encrypted DNS. Firefox turns on DNS over HTTPS by default in the US, and Chrome, Edge, and Android have a Secure DNS or Private DNS setting. It stops the network from swapping the address of the site you asked for. One caveat: some captive portals cannot load until you are past the login page, so if the portal never appears, turn encrypted DNS off, log in, and turn it back on.
• Never install anything a login page asks for. Not a certificate, not a profile, not an app. Close the page and use another network or your phone's cellular data.
• Keep the device updated. Most of what public WiFi attacks relied on in the past was patched years ago. The people still getting caught are running old software.
• Forget the network when you leave. This removes the saved name, so your device will not auto-join a copy of it somewhere else.

Is hotel WiFi safe?

Hotel WiFi at a major chain is as safe as any public network: guest devices are isolated from each other and the portal is the hotel's own. The problems with hotel WiFi are about access, and a VPN fixes none of them.

Device limits. Many hotels allow two or three devices per room on the free tier and charge for more. A family with phones, a tablet, and a laptop hits the limit before dinner.

Devices that cannot log in. A streaming stick, a game console, a Kindle, or a smart speaker has no browser to show the login page. It sees the network and never gets past it.

Client isolation. Hotels keep guest devices from seeing each other, which is good for security and bad for anything that needs two of your devices to talk: casting from a phone to a Chromecast, AirPlay to an Apple TV, or a wireless printer you brought.

Daily re-login. Most hotel portals expire every 24 hours. Every device logs in again, every day.

The Ethernet jack in the wall. Older hotels and many short-term rentals still have one. It is usually faster and more stable than the WiFi, and nothing you carry can use it without a router.

A travel router fixes all five. The section after next explains how.

Is airport WiFi safe?

Large airports run managed networks with device isolation, and the main danger is the evil twin, because the official network names ("DEN Free WiFi," "SFO Free WiFi") are public knowledge and the terminal is full of distracted people. Confirm the exact name on airport signage before you join, and turn off auto-join afterward.

Some airports and hotels now support Passpoint, a WiFi Alliance standard that signs your phone in with a stored credential instead of a login page. Heathrow and Newark are among the airports offering it through carrier and loyalty-app partnerships, and the Wireless Broadband Alliance's OpenRoaming federation, which is built on Passpoint, has passed one million hotspots worldwide. A network that connects you with no portal at all is harder to spoof than one that shows a page.

Cafés are lower risk but less consistent. The owner set the router up once and may never have updated it. Treat the network as public on your laptop, keep sharing off, and if the login page asks for more than an email or a click, skip it.

How does a travel router make public WiFi safer?

A travel router is a pocket-sized router that connects to the venue's WiFi or Ethernet, then broadcasts its own password-protected network for your devices. Instead of six devices each joining the hotel's network, one device does, and everything you own sits behind it. That one change fixes most of what is on this page.

• Your devices are on a private, encrypted network. The hotel, the café, and the stranger at the next table see one device, the router. Your phones and laptops sit behind its firewall with WPA2 or WPA3 encryption, the same as at home.
• One login covers everything. You log into the captive portal once, through the router, and every device behind it is online. The hotel counts one device. The streaming stick and the game console work because they never see the portal.
• Your devices can see each other. Casting, AirPlay, printing, and file sharing work the way they do at home, because they are on your network, not the hotel's.
• A VPN on the router protects every device at once. Current travel routers have a WireGuard or OpenVPN client built in. Turn it on with a Proton VPN or Mullvad configuration file and the TV, the console, and the kids' tablets are inside the tunnel without an app on any of them. Our hardware VPN router guide covers the setup, and our VPN kill switch guide explains the setting that keeps traffic from leaking if the tunnel drops.
• The Ethernet jack becomes usable. Plug the wall jack into the router's WAN port and your whole kit is on wired hotel internet.
• Evil twins get harder. Your devices only ever join your router's network, which has a name and password nobody else knows. The router is the only thing choosing a venue network, and you pick that one deliberately in its app.

Travel routers run on USB-C power, so they work from a wall adapter or a power bank, and current models weigh between 39 and 300 grams. Our travel router comparison covers thirty models. The four in the table below are the ones that fit this job best.

Which travel routers handle hotel and airport WiFi best?

Every router in this table does the one-login trick, runs a VPN client, and takes Ethernet or WiFi as its internet source. WiFi figures are the manufacturer's maximum link rates; VPN figures are the manufacturer's published lab numbers where available.

The TP-Link Roam 7 and TP-Link Roam 6 AX1500 links in this section are part of paid Amazon Creator Connections campaigns. As an Amazon Associate, ModemGuides.com earns from qualifying purchases.

Model	WiFi standard	Wired ports	VPN client	Weight (g)	Where to buy
GL.iNet Beryl AX (GL-MT3000)	WiFi 6, 574 + 2,402 Mbps	1x 2.5G WAN, 1x Gigabit LAN	WireGuard 300 Mbps, OpenVPN 150 Mbps	196	ModemGuides
TP-Link Roam 6 AX1500 (TL-WR1512X)	WiFi 6, 300 + 1,201 Mbps	2x Gigabit	OpenVPN and WireGuard, client and server	Not published	Amazon (paid affiliate link)
TP-Link Roam 7 BE3600 (TL-WR3602BE)	WiFi 7, 688 + 2,882 Mbps	1x 2.5G, 1x Gigabit	OpenVPN, WireGuard, PPTP, L2TP	Not published	Amazon (paid affiliate link)
GL.iNet Beryl 7 (GL-MT3600BE)	WiFi 7, 688 + 2,882 Mbps	2x 2.5G	WireGuard 1,100 Mbps, OpenVPN 1,000 Mbps	205	Amazon (affiliate link)

GL.iNet Beryl AX (GL-MT3000)

The travel router on our own product page, and the one for anyone who wants a VPN on every device without reading a manual. WiFi 6, a 2.5G Ethernet port, 300 Mbps WireGuard, and GL.iNet's firmware with the VPN client, AdGuard Home ad blocking, and a kill switch built in. It weighs 196 grams. Ours are Grade A refurbished, tested in the US, with a 90-day warranty and 30-day returns. See the Beryl AX at ModemGuides.

TP-Link Roam 6 AX1500 (TL-WR1512X)

The easiest first travel router. WiFi 6, two Gigabit ports, USB-C power, up to 60 devices, and a one-step portal login through the Tether app. It supports OpenVPN and WireGuard as client and server. Pick it if the job is sharing one hotel login across a family's devices and the VPN is a bonus. Our Roam 6 AX1500 guide has the full breakdown. See the Roam 6 AX1500 on Amazon (paid affiliate link).

TP-Link Roam 7 BE3600 (TL-WR3602BE)

The same one-step portal login and Tether app as the Roam 6, with WiFi 7, a 2.5G port, support for up to 90 devices, and a world-compatible power adapter in the box. VPN support covers OpenVPN, WireGuard, PPTP, and L2TP, so it works with older corporate VPNs as well as consumer ones. It is the pick for someone who travels with a WiFi 7 laptop and wants the router to last several hardware generations. See the Roam 7 on Amazon (paid affiliate link).

GL.iNet Beryl 7 (GL-MT3600BE)

The Beryl AX's successor and the fastest VPN in a pocket router: GL.iNet rates it for 1,100 Mbps WireGuard and 1,000 Mbps OpenVPN, so the VPN never becomes the bottleneck on a hotel connection. WiFi 7, two 2.5G ports, 205 grams, and it can charge a tethered phone back through its USB port. Buy it if you run a VPN all the time and want to forget it is there. See the Beryl 7 on Amazon (affiliate link).

How do I get past a hotel login page with a travel router?

Connect the router to the hotel network from its app, then open the hotel's login page on your phone; once you sign in there, every device behind the router is online. The login page has to reach a screen and the router does not have one, which is the step that confuses new owners. Here is how it works on each type of router, and what to do when it does not.

TP-Link Roam routers handle it in one step. Connect the router to the hotel's WiFi in the Tether app, and the app opens the hotel's login page for you. Sign in and the router is through.

GL.iNet routers work almost the same way. Join the hotel's network from the router's app or admin page, then open any website on your phone. The portal appears on your phone, you log in, and the router is online.

Older or simpler routers (TP-Link Nano models, for example) need a manual step: connect your phone to the router, open a browser, type a plain address such as neverssl.com or captive.apple.com, and the portal loads.

When the portal refuses to appear, work down this list:

• Open a plain http address (the two above work) rather than an https one. Portals cannot interrupt an encrypted page.
• Turn off the router's VPN and any encrypted DNS until you are logged in, then turn them back on.
• If the hotel ties the login to a specific device (you logged in on your laptop first and the router cannot get through), use the router's MAC clone setting to copy the laptop's hardware address. The hotel then sees the router as that laptop.
• If you are not sure the portal in front of you is the hotel's, stop. Join the hotel network on your phone directly, confirm the portal looks the same, and if it does not, ask the front desk.

Do I need a VPN on public WiFi?

For most people, most of the time, no: HTTPS already hides the contents of your traffic from the network. A VPN adds three things on top. It hides which sites you visit from the venue, it stops a tampered network from redirecting unencrypted background traffic, and it covers the odd app or device that still sends something in the clear. If you use public WiFi daily for work, or handle anything sensitive on it, those are worth having. We recommend Proton VPN or Mullvad, and a VPN on a travel router is the version that protects every device without an app on each one.

What a VPN does not do is protect you from the login page. The portal sits in front of the tunnel, so a fake portal gets your room number and card before the VPN has anything to encrypt. And a VPN cannot help a streaming stick that has no way to log in at all. For both of those, the router is the answer.

FAQ

Is hotel WiFi safe for banking?

Yes, once you have confirmed the network is the hotel's. Your bank's app and website encrypt everything, so the network cannot read your session. The risk is a fake network or fake login page capturing your details before you reach the bank. If the login page did not ask you to install anything and the name matched what the front desk gave you, banking is fine. If you are unsure, use your phone's cellular data for that one task.

Can someone see what I do on public WiFi?

They can see which sites and services your device contacts, because the destination address is not encrypted. They cannot see what you typed, read, or did there, as long as the site uses HTTPS, which nearly all do. A VPN hides the destinations too.

Does a VPN protect me from an evil twin network?

Partly. Once the VPN tunnel is up, the attacker running the fake network sees only encrypted traffic going to your VPN server. But the attacker still controls the login page you saw before the tunnel came up, and can block the VPN from connecting at all. Verifying the network name is the defense; the VPN is the backup.

Why won't the hotel login page load on my laptop?

Usually because the first page your browser tried was encrypted, and the portal cannot interrupt an encrypted page. Type a plain address like neverssl.com. If that fails, turn off your VPN and any encrypted DNS setting, load the page, log in, and turn them back on. If the hotel ties your login to one device and you switched devices, log in again or clone the first device's address on a travel router.

Is public WiFi safe with a travel router?

Safer than without one. Your devices sit on your own encrypted network behind a firewall, only the router touches the venue's network, and a VPN on the router covers everything at once. The router cannot verify that the hotel's network is the hotel's, so the first step is still the same: get the exact network name from staff.

Should I turn off WiFi when I'm not using it while traveling?

It helps. A phone with WiFi on is constantly looking for networks it remembers, which is exactly what an evil twin waits for. If auto-join is off for public networks, leaving WiFi on is fine. If it is not, switching WiFi off between uses is the simplest protection there is.

Is a hotel's wired Ethernet jack safer than its WiFi?

Slightly. Nobody can broadcast a fake Ethernet jack, so the evil twin problem disappears, and wired connections are usually faster and more stable. The portal and device-isolation issues are the same, and you need a travel router to share the jack with more than one device.