Staying safe on public Wi-Fi

Public Wi-Fi is convenient and risky at the same time: you do not know who runs the hotspot, whether the router has been tampered with, or who else is on the network. The good news is that most of the risks have clear countermeasures. This article first explains where the risks come from, then what HTTPS and a VPN each solve, and ends with a checklist you can follow as written.

The types of risk

Plaintext on open networks. On a network without a password, or with a shared one, data travels through the air in a form that other devices on the same network can capture. Any unencrypted application traffic (sites still on HTTP, API calls from older apps) can be read directly.

Rogue hotspots. An attacker can set up a network with the same name as the real one, for example a second "Cafe_Free_WiFi" inside the cafe. Devices tend to join whichever signal is stronger, and from then on all traffic passes through the attacker's equipment.

Man-in-the-middle attacks. Even when the hotspot itself is honest, another device on the network can impersonate the gateway through techniques such as ARP spoofing and intercept or alter other devices' traffic.

DNS tampering. The network assigns your DNS server. Manipulated answers can lead you to look-alike sites or make certain services mysteriously unreachable.

Malicious captive portals. A sign-in page may ask you to install a "certificate" or a "client"; in reality it plants a root certificate that can decrypt your traffic, or malware.

Exposure of the device itself. File sharing left on, AirDrop set to everyone, or unpatched system vulnerabilities become entry points on an unfamiliar network.

What HTTPS protects

HTTPS sets up TLS encryption between the browser and the website. It prevents content from being read or altered and verifies the site's identity. The vast majority of websites use it today, and it is the most basic and most important protection. It does have blind spots:

Destinations remain visible. DNS lookups are usually plaintext, and the hostname in the TLS handshake (SNI) is plaintext in most cases. The local network cannot see what you do on a site, but it knows which sites you visit.
It covers only browsers and apps that use TLS. Plenty of apps, games and smart devices still send unencrypted traffic.
It relies on certificate validation. If a malicious portal talked you into installing a root certificate, HTTPS protection is gone. Never click through a browser certificate warning.

How a VPN relates to HTTPS

A VPN complements HTTPS rather than replacing it. It builds an encrypted tunnel between the device and a remote node, and the traffic of every app on the device travels inside it:

The local network sees only encrypted UDP traffic heading to the node: no DNS queries, no hostnames, no application data. Rogue hotspots and man-in-the-middle attackers have nothing to work with on that leg.
Older apps that do not use TLS are protected as well.
The tunnel ends at the node; beyond it, data travels in whatever form the app uses, so HTTPS remains necessary.

With a VPN, the local network loses its vantage point, while the node operator is in a position to see traffic metadata. Choose a provider that states its logging posture precisely. TP VPN does not record browsing content, DNS queries or destination addresses; see What "no activity logs" really means.

The checklist

Before you connect

Ask staff for the exact network name; do not guess from the name alone.
Turn off auto-join so the device cannot silently attach to a same-named hotspot later.
Make sure the system and your everyday apps are up to date.
Turn off file sharing, printer sharing and similar local services; set AirDrop or nearby sharing to contacts only, or off.
Install and sign in to your VPN app in advance rather than downloading it on an unfamiliar network when you need it.

After you connect

If the network has a sign-in page (captive portal), complete it in the browser first and then turn on the VPN; the tunnel usually cannot be established before the portal is done.
Turn on the VPN and confirm the status shows Connected. In TP VPN you can enable Auto-connect on launch in Settings so that opening the app establishes the tunnel automatically.
Refuse any page that asks you to install a certificate, a profile or a "dedicated client".
Stop immediately when the browser shows a certificate warning; do not continue to the site.
Avoid highly sensitive operations such as bank transfers on unknown networks. If you must, confirm the VPN is connected and the site uses HTTPS.
Protect important accounts with passkeys or two-step verification, so that a leaked credential alone is not enough to impersonate you.

After you leave

Forget the network in the system settings so the device does not reconnect automatically next time.
If you saw anything suspicious while on that network, change the credentials of the accounts involved as soon as you are on a trusted network.

Is mobile data the better choice?

Mobile data is encrypted by the carrier over the air and is usually safer than open Wi-Fi; using your phone as a hotspot for a laptop is a sound alternative. Mobile networks, however, are only protected up to the base station, and DNS and hostnames are visible to the carrier. If you want destinations hidden from the local network, or need a steadier cross-border route, a VPN still applies.

How TP VPN behaves on public Wi-Fi

TP VPN uses WireGuard: the handshake takes a single round trip and the tunnel resumes in place when the network changes. Switching from public Wi-Fi to mobile data, or roaming between several hotspots in the same venue, needs no new sign-in, and if the tunnel drops unexpectedly the app reconnects with exponential backoff. Key pairs are generated on the device and the private key lives only in the system's secure storage; it is never transmitted, on any network.