How a VPN protects you on public Wi-Fi
Public Wi-Fi at cafes, airports and hotels is rarely as private as it feels. Here is how a VPN protects your data on shared networks — and where it stops.
Public Wi-Fi is convenient. That is why you join it. Airport gate, cafe window, hotel lobby, sometimes the library when the mobile coverage gives up. The network is shared with people you do not know, run by someone whose job is not “keep my inbox private.”
A VPN encrypts the path between your device and a server you choose. That is the protection. The rest of this post is what that means in practice, and what it still cannot do. The same risks show up on public Wi-Fi anywhere — cafe, airport, hotel lobby, library — not just on the network you already know.
What the network can see without a VPN
Most modern apps use HTTPS. That already encrypts the page or API call between you and the bank, the mail host, the news site. So the old story — “anyone can read your password in the clear” — is less true than it was a decade ago. Good.
What still leaks on a typical shared network:
- Which sites you are talking to. DNS lookups and other metadata often show names even when the content is HTTPS.
- Anything that is not HTTPS. Old apps, odd captive-portal pages, a forgotten tool you installed in 2018.
- The fact of your presence on that network, which is fine, and the chance to trick you onto a lookalike network, which is less fine.
Lookalike networks — a laptop broadcasting a name that looks like the cafe or the airport — still work because people tap the first familiar SSID. Man-in-the-middle tricks still work on anything that isn’t locked down. Packet capture still works on traffic that was never encrypted. None of this requires a movie villain. It requires a shared radio and someone bored.
What the VPN changes
Once the tunnel is up, your device sends encrypted traffic to the VPN server. The cafe sees a connection to Arresti. It does not see the newspaper, the bank, or the video call inside the tunnel. DNS for those destinations goes through the tunnel too.
If you joined a lookalike network by mistake, the operator of that network still cannot read the inside of the tunnel. They can still try to dump you off, or refuse the connection, or serve a fake captive portal. The VPN is not a force field around the laptop. It is a locked pipe for the bits you send once it is connected.
Your apparent IP address becomes the server’s address. That is useful for privacy on the local network. It is also why some sites treat you as being in another country. That side-effect is a routing fact, not a personality change. You are still you on any site where you log in.
What it does not change
A VPN does not replace HTTPS. You still want updated apps. It does not stop you typing your password into a fake website you opened yourself. It does not replace multi-factor authentication. It is not antivirus.
It does not hide you from a site where you have an account. Arresti holds your email, country, and Stripe billing records. We do not store browsing activity. A valid legal request can still compel the account information we have. Read the Privacy Policy if that distinction matters to you — it should.
Connect the VPN after you get through a captive portal, then do the things you care about. Connecting first can leave you stuck on the hotel’s “accept terms” page. Hotel-specific habits are in hotel Wi-Fi: how to stay private on a shared network.
How to use it without turning it into a project
- Install before you need it. Phones and Mac: the Arresti app. Windows: OpenVPN plus an imported
.ovpnfile. Do the Windows step at home. Windows guide. - Turn off auto-join on open networks so your phone does not pick a stranger’s SSID in your pocket.
- Use mobile data for banking or government logins if you are uneasy, even with a VPN. Caution is allowed.
- Keep the OS patched. The tunnel cannot fix last year’s bug.
One Arresti plan covers up to 5 devices. AUD $3.99 a month or AUD $43 a year. 30-day money-back guarantee. More product context: what a VPN is.
If you travel, the same tunnel is the one you want on hotel Wi-Fi and at the gate. The travel-shaped version is why a VPN matters when you travel.
The point
Public Wi-Fi is a shared pipe. A VPN makes the pipe boring: encrypted traffic to a server you chose, then out to the internet. That is the protection. Everything else is still on you — passwords, updates, and not treating a cafe as a vault.
Sign up here if you want that tap on the phone.