VPN for public Wi-Fi: what the network sees and what a tunnel changes

Is public Wi-Fi safe?

Safer than it used to be, but not private. HTTPS encrypts the content of each page, not the fact that you loaded it: the network still sees the addresses you connect to, the site names in your DNS lookups and, on most connections, the hostname sent when the TLS session opens.

That is why the old story about someone at the next table reading your email is mostly out of date, and why the network operator still ends up with a useful record of your day.

Put those together and whoever runs the network, or whoever can watch it, gets a timestamped list of the sites and services you used without decrypting a single page. Phone apps are no different: they talk to their servers over HTTPS, but the destinations and the timing are visible to the router in exactly the same way.

The password on the wall changes less than people assume. A shared Wi-Fi password keeps passers-by off the network; it does not separate you from the other guests who typed the same password, and it does nothing about whoever operates the router. In this guide, "public Wi-Fi" means any network you do not control, with or without a password.

The real risks on hotel and airport Wi-Fi

Some attacks on open networks are cheap to run and hard to notice from the user side. The list below is what deserves attention; a hacker cracking your bank session through HTTPS is not on it.

• Rogue access points: someone broadcasts a network with the same name as the airport or hotel Wi-Fi. Your phone remembers the name from last time and joins on its own, and now your traffic passes through hardware a stranger controls.
• DNS tampering: the router answers your lookups with the wrong addresses, steering a typed URL to a look-alike login page.
• Metadata collection: the operator, or the analytics vendor behind its captive portal, logs which devices visited which sites and when, and may sell or combine that data.
• Unencrypted holdouts: sites and apps still on plain HTTP are rare, but on those the content travels in the open.
• Traffic injection: ads or notices inserted by the network itself into unencrypted pages.

What a VPN changes on a public network

With the tunnel up, the network sees encrypted packets leaving your device for one destination, the VPN server, and encrypted packets coming back. It no longer sees which sites you visit, because your DNS lookups travel inside the tunnel and are answered at the other end, and it no longer sees the hostnames at the start of each connection. Rogue access points and DNS tampering lose their leverage: the local network is not resolving or routing anything for you anymore, it is carrying ciphertext to a fixed address.

The protocol matters more here than in most scenarios. SuaVPN runs on WireGuard, which you use through the official WireGuard app on your phone or laptop after importing a profile from a QR code or a .conf file. WireGuard re-establishes the tunnel quickly when the underlying network changes, which happens constantly in an airport as your phone flips between the terminal Wi-Fi and cellular data. Each device has its own key pair, so a phone left in a taxi can be revoked from the panel without touching your other devices.

Pair the tunnel with your operating system's own safeguards. On Android, "Always-on VPN" together with "Block connections without VPN" cuts off internet access if the tunnel drops, the behavior other services sell as a kill switch. On iPhone, WireGuard's on-demand rule can bring the tunnel up automatically on any Wi-Fi network, so there is nothing to remember. The Android and iPhone guides walk through both settings.

What a VPN does not fix

A VPN protects the path between your device and the VPN server. It does nothing about a fake site you opened yourself from a link in an email, a malicious attachment, or a password reused across accounts. It does not hide who you are from services you sign in to; your email provider knows it is you regardless of which IP address the login came from. Cookies, browser fingerprinting, and logged-in sessions carry on as before.

There is also a shift of trust worth stating plainly. On public Wi-Fi without a VPN, you are trusting the hotel. With a VPN, you are trusting the VPN provider instead, because its server is now where your traffic exits onto the internet. That is why a written logging policy matters more than any feature list, and why ours spells out what is stored and what is not.

One last gap: your device is still physically on the hotel's local network, and so are the other guests. Before you connect, turn off file and printer sharing, set AirDrop to contacts only, and on Windows mark the network as public when prompted. Those are one-time settings, and they protect you from the room next door in a way no tunnel can.

Does a VPN work with hotel Wi-Fi login pages?

Yes, as long as you accept the portal first. A captive portal works by intercepting your first web request, and a tunnel that is already up blocks that interception, so the login page never appears. Join the network, accept the terms in the browser, then switch the tunnel on.

Two things can still go wrong. Some networks make you sign in again every day or after a set number of hours, so a tunnel that suddenly stops passing traffic may just mean the portal wants you back; turn the VPN off, reload a page, accept, and turn it on again. Less often, a network blocks the kind of traffic WireGuard uses, and the handshake never completes no matter what you try. Check the location on the status page first; if the server is up, a phone hotspot is the reliable workaround, and the support page can help you tell the two cases apart.

The portal is the page where you accept the terms, type a room number, or watch an ad before you get online. In the right order, getting past it takes a minute:

• Join the Wi-Fi and open your browser. If the portal does not appear on its own, open any plain http:// address to trigger it, then accept the terms.
• Confirm the internet works without the VPN by opening any site.
• Turn the tunnel on in the WireGuard app. If you use Always-on VPN on Android or an on-demand rule on iPhone, switch it off before the portal and back on afterward.
• Open the tunnel details and confirm a recent handshake. If you like, visit a site that shows your IP address to see the server's location instead of the hotel's.
• When you leave the building, leave the tunnel on. It carries over to cellular data with no change on your part.

Phone hotspot or public Wi-Fi, and where SuaVPN fits

Tethering your laptop to your phone is safer than an open network for one plain reason: the network is yours, and nobody else is on it. It is not a substitute for the tunnel, though. Your carrier still sees every destination, and abroad you may be paying roaming rates for the data. A VPN on the laptop covers the hotspot and the hotel Wi-Fi with the same profile. What it will not do is lower your data usage; the tunnel adds a small overhead rather than removing any, so plan your roaming allowance as if the VPN were not there.

Here is what SuaVPN offers for this use case. You get WireGuard profiles for the locations listed on the status page, a panel to manage devices, and three plans set by device count: Basic with 3, Pro with 5, and Family with 10. Current prices are on the pricing page. Card payments go through Stripe and work from anywhere, with prices shown in Brazilian reais, which suits Brazilians living or traveling abroad as well as anyone else. There is no lock-in, you can cancel at any time from the panel, and you have seven days to ask for a full refund under Brazilian consumer law, long enough to test the tunnel on the actual hotel or airport network you care about.

And what it does not offer, so you can decide before paying: no SuaVPN-branded app (you use the official WireGuard client), no browser extension, no dedicated IP, no business plan, and no split tunneling, so all of a device's traffic goes through the tunnel once it is on. If your setup needs any of those, another service will fit better. Small teams working from coworking spaces will find the same ground covered in the business VPN guide.