Best VPNs for Public Wi-Fi: Ranked for Cafés, Hotels and Airports

The three highest page scores

The network sub-score covers server spread, streaming and torrenting support among other inputs, and Proton VPN holds the best of the three at 8.7. X-VPN trails on security (4.6): it does not state DNS leak protection, does not state a security audit and does not say whether its apps are open source; its no-logs claim carries an ISAE 3000 attestation with no auditor named. On billing, CitadelVPN does not auto-renew and refunds within 14 days; Proton VPN and X-VPN auto-renew and refund within 30 days. PureVPN (6.05), NordVPN (6.01) and Surfshark (5.94) come next.

What a VPN changes on café, hotel and airport Wi-Fi

HTTPS already encrypts most website traffic, so the padlock on your bank page survives a café router. What the hotspot still logs is which domains your phone resolves and when, plus anything from apps that skip encryption. A fake hotspot with a familiar name reads the same, and unencrypted traffic plus DNS fall to it outright. With a VPN on, the operator gets one encrypted stream to a single server, nothing more.

What to check beyond the kill switch

DNS leak protection is the odd one: 81 of 159 services do not state it. Silence is not proof of absence, but check your visible IP address and WebRTC leaks with the VPN on before trusting such an app at a crowded airport. The entry bar here is the kill switch itself: it cuts traffic when hotel Wi-Fi drops mid-session or the phone jumps to mobile data.

Hotel and airport login pages and the VPN

The captive portal that asks for a room number has to appear before any tunnel can start, and a strict kill switch blocks all traffic until the VPN connects, so the portal never loads. Join first, complete the portal in the browser, then connect the app.

Setting it up on iPhone and Android so it stays on

In the app, look for auto-connect on untrusted networks, which starts the tunnel whenever the phone joins one it does not know; keep home Wi-Fi marked trusted. Android adds a system-level backstop in settings: Always-on VPN plus Block connections without VPN. Choose WireGuard first; where the network blocks those ports, move to IKEv2 or a stealth mode.

What a VPN won't fix on public Wi-Fi

Phishing pages, fake login forms and malware arrive as usual, so updates and two-factor sign-in still matter. The FTC's consumer advice is blunt about it: encryption covers the padlocked site, and scammers use encryption too. With the tunnel on, the VPN provider is the one that can see the traffic the hotspot used to see, which is why an independent no-logs audit matters: 29 of these 159 services have one, 60 do not and 70 do not state it.

Public Wi-Fi VPN FAQ

Short answer: which VPN to use on public Wi-Fi

Put a VPN that includes a kill switch on the phone that actually travels with you, let auto-connect handle the rest, and run a leak check after connecting. Cheapest paid plan here: €0.57 a month; median: €2.86.