Public wifi and VPN for travellers

A VPN encrypts traffic between your device and the VPN server, and hides your real IP address from the sites you visit. On hotel, cafe, airport and train wifi, that is the main benefit: the network operator can no longer read or redirect what you send, and cannot easily tell which sites you are on.

It does not make you anonymous. The VPN provider can see your traffic unless it truly keeps no logs, and the sites you log into still know who you are. It does not stop malware you choose to install, it does not validate a phishing page, and it does not protect an account whose password you reused in five places.

It also does not fix a bad connection. On a weak network, a VPN adds overhead and can make video calls worse. If the wifi is unusable, switch to mobile data rather than fighting it.

One more limit worth knowing: some streaming services and banks block known VPN addresses, and a few countries restrict VPN use. Check the rules for your destination before you rely on it.

Prices below are 2026 estimates for planning; check current plans before you buy. The pattern is stable: paid VPNs cost less per month on a one- or two-year plan, travel eSIMs cost a few dollars per gigabyte, and free wifi costs nothing but asks you to trust a stranger's router.

A paid VPN typically runs about US$3–13 per month depending on plan length and provider, with a money-back window of around 30 days. Free VPN apps exist, but they usually pay for themselves with ads, limited servers, or by selling aggregated data; that trade is poor for banking and work logins.

Travel eSIMs are the simplest private option for a phone. A 5–10 GB regional plan commonly lands around US$5–20, and a 1 GB short-trip plan can be a few dollars. A local physical SIM bought at the airport is often cheaper per gigabyte but needs an unlocked phone and a shop visit. Roaming from your home carrier is the most convenient and usually the most expensive.

A portable travel router or a phone hotspot lets you put every device behind one connection. Your phone hotspot is free with your plan; a travel router is a one-off cost and is mainly useful for laptops and shared rooms.

Rules vary by country and change without much notice. Some places restrict or require registration for VPN use, some block specific services, and some require hotels to record guest details before giving wifi access. Treat any statement about a specific country as something to verify close to departure, not as settled fact.

Captive portals are the everyday exception. Hotel, airport and cafe networks usually open a login page before granting access. If that page does not appear, open a plain HTTP page or the network's own address to trigger it; if it still fails, forget the network and rejoin.

Corporate and university networks are a different case. If your employer provides a VPN, use it for work, and keep personal browsing off the work tunnel. Some employers also forbid split tunnelling, so read the policy before you mix the two.

Satellite and in-flight wifi is its own category: expensive, high latency, and often unsuitable for VPNs or calls. Download what you need before boarding.

Finally, public computers in hotel lobbies and internet cafes are the weakest link of all. Assume anything you type can be captured, and never log into banking or email on one.

Joining the wrong network. Attackers set up hotspots with names one character off the real one, or named after the cafe you are sitting in. Ask staff for the exact network name, and turn off auto-join so your phone does not pick a network for you.

Trusting the padlock too far. HTTPS protects the content of the page, but the network still sees the domain, and a phishing site can have a padlock too. Check the address bar, not just the icon.

Reusing passwords. One leaked password from an old breach is enough to open your email, and email resets everything else. Use a password manager and a separate password for every account.

Skipping two-factor authentication. It is the single control that stops a stolen password from becoming a stolen account. Prefer an authenticator app over SMS when you travel.

Leaving file sharing on. Open sharing on a laptop in a cafe exposes files to anyone on the same network. Turn it off before you leave home.

Doing banking on hotel wifi without a VPN. Use mobile data for money, or at minimum a VPN plus two-factor authentication.

Buying a free VPN. Free apps have to make money somehow, and the usual ways are ads, data limits and data resale.

Forgetting the fallback. No eSIM, no local SIM, no offline maps, and a dead network leaves you stuck at the airport.

Run this list in the week before departure, then repeat the short version the night before.

Devices: install and test the VPN, turn on the kill switch, set auto-connect for untrusted networks, turn off auto-join and file sharing, and set a short screen lock.

Accounts: turn on two-factor authentication, move logins into a password manager, and save backup codes offline. If you are changing SIMs, make sure your 2FA method does not depend on SMS to your home number.

Data: buy and install a travel eSIM or confirm your roaming plan, and note the local SIM options at your arrival airport. Check your phone is carrier-unlocked.

Offline: download maps, tickets, boarding passes, hotel and insurance documents, and a translation pack. Save a screenshot of your accommodation address in the local script.

Documents: keep a photo of your passport and insurance policy in encrypted storage, and a paper copy separate from the original. If a device is lost or stolen, you will need the policy number and the local police report for a claim.