What changes on a shared network
On a public network you do not control who else is connected, how the router is configured, or whether the network name belongs to the venue at all. Modern websites and apps encrypt traffic by default, which removes much of the old risk, but two weaker points remain: connections that are not properly encrypted, and your own habits — signing in, approving prompts, or leaving devices discoverable.
Before you connect
- Confirm the network name with staff instead of picking the strongest signal. Look-alike names are trivial to create.
- Turn off automatic joining for open networks so your device does not reconnect to a similar name later in another city.
- Set the network as public when your operating system asks, which disables file and printer sharing.
- Update your browser and system before departure, while you are still on a network you trust.
Encrypt the connection itself
A reputable VPN wraps your traffic in an encrypted tunnel between your device and the provider's server, so the local network sees far less about what you are doing. Two points are worth understanding:
- A VPN moves trust rather than removing it — you are trusting the provider instead of the café. Choose one whose logging and jurisdiction policies you have read.
- A VPN does not stop phishing, malware, or you typing a password into a fake page. It protects the transport, not your decisions.
Where a VPN is not available, using your phone's mobile hotspot for anything sensitive is usually a better option than an unknown open network. If you are still deciding whether you need one, see do you need a VPN for international travel, or read our selected provider, Proton VPN for secure travel.
Protect the accounts, not just the network
- Enable two-factor authentication on email, banking, cloud storage and password management before you travel. Prefer an authenticator app or hardware key over SMS, which depends on roaming.
- Use a password manager so each service has a unique password and you are not retyping credentials from memory on unfamiliar networks.
- Save your recovery codes somewhere you can reach without the device you are carrying.
- Sign out of sessions you no longer need, especially on shared or borrowed computers, and never save credentials in a hotel business-centre browser.
Habits while you are online
- Check that the address bar shows the exact domain you expect before signing in.
- Treat unexpected certificate warnings and login pop-ups as a reason to stop, not a box to dismiss.
- Use a privacy screen and sit with your back to a wall for anything you would not want photographed.
- Postpone high-value actions — transfers, password changes, tax or legal documents — until you are on a connection you trust, if they can wait.
- Disable Bluetooth and AirDrop-style sharing when you are not using them.
After the trip
Remove saved networks you will not use again, review the active sessions and connected devices in your main accounts, and change any password you entered on equipment that was not yours. This takes a few minutes and closes most of the loose ends a trip leaves behind.
The short version
Verify the network, encrypt the connection, protect the accounts with second factors, and delay anything sensitive that can wait. These steps reduce risk substantially, though no combination of them removes it entirely.
Continue reading
- Hotel & airport Wi-Fi security: a practical traveler's guide — a routine for lounges, lobbies and hotel rooms.
- Do you need a VPN for international travel? — what it protects and what it does not.
- Proton VPN for secure travel — the privacy solution we selected and why.