Is Hotel Wi-Fi Safe? Airport and Public Wi-Fi Risks

Is hotel Wi-Fi safe? The short answer

Public Wi-Fi is not risky because it is public. It is risky because you do not control it and cannot verify who else does. Three parties may be able to observe your traffic: the network operator, which can log what you connect to and when; other people on the same network; and anyone running a fake access point nearby. What they can see depends on how your apps connect:

• The content of HTTPS pages and modern apps is encrypted: passwords and messages cannot be read on the network unless you click through a certificate warning.
• Which services you use is often visible: site names can leak through DNS lookups and at the start of a secure connection, and destination IP addresses are always visible.
• Unencrypted traffic can be read and altered. Old HTTP sites, some smart-device apps and poorly built software still send data in the clear.
• Your device itself can be reached if the network does not keep guests apart and you have sharing services switched on.

So is public Wi-Fi safe? For most everyday tasks, yes, if your device is configured sensibly and you take warnings seriously.

Hotel Wi-Fi security risks

A shared password is not private encryption

Many hotels give every guest the same password. That keeps passers-by out but does little to protect guests from each other. On a WPA2-Personal network, anyone who knows the passphrase and captures the moment your device joins can decrypt your Wi-Fi traffic. WPA3-Personal closes this gap, because a passive listener cannot derive each connection's keys even with the password. Many guest networks still run WPA2, though, and some have no password at all, which usually means no Wi-Fi encryption.

A shared password has a second weakness: anyone who knows it can set up a look-alike network with the same name and password.

Other guests on the same network

Well-run guest networks enable client isolation, which stops connected devices from talking to each other directly. You cannot easily confirm it from your room. Without it, other guests can discover and probe your device: shared folders, media servers, remote desktop or a development server left running on your laptop become reachable from down the corridor.

Is airport Wi-Fi safe? Evil twins and fake hotspots

Airports, stations and cafes add a different problem: you cannot tell which network is genuine. An evil twin is an access point that copies the name of a legitimate network, such as the airport's free Wi-Fi. Network names are not verified, so your phone cannot tell the two apart, and if it has joined a network with that name before, it may connect to the fake one automatically.

On a fake hotspot, the attacker effectively runs your network: they see unencrypted DNS lookups and every destination address, can show a convincing login page and can try to intercept connections. HTTPS still protects you, but only if you do not accept a certificate warning or type credentials into a page the hotspot serves.

Signs that a network deserves suspicion:

• Two networks with the same or nearly the same name, for example one with an extra word or digit.
• A login page that asks for your email or social media password, or for card details, just to get online.
• Certificate warnings on sites that normally load without problems.

The most effective habit: confirm the exact network name with staff or official signs, and turn off auto-join for open networks so your device never connects without asking.

Captive portals and how to log in safely

Most hotel and airport networks use a captive portal: after you join, a login or terms page appears before anything else loads. Portals are normal, but they are also the easiest place to phish you, because you expect to type something there.

1. Join the network whose name you confirmed with staff or signage.
2. Let your device open the login window by itself. If nothing appears, open a new browser tab; the network usually redirects you to the login page.
3. Check what the page asks for. A room number and surname, an access code or accepting terms is normal. An email or social media password is a red flag, and so are card details on a network advertised as free; if access is paid, confirm the price with reception.
4. Never install anything a portal offers: no apps, configuration profiles or "security certificates". A root certificate on your device lets whoever holds its key impersonate websites and read traffic you believe is encrypted.
5. Once you are online, connect your VPN and leave it on for the rest of the session.

A VPN that connects automatically may fail until you log in to the portal, and a setting that stops all traffic outside the VPN can keep the login page from loading. Pause the VPN, finish the login, reconnect, and do nothing sensitive in the gap.

What HTTPS protects and what it does not

HTTPS is the main reason public Wi-Fi security is far better than it used to be. It encrypts the connection between your browser or app and the website and verifies the site's certificate, so someone on the network cannot read or quietly change the page, your password or your session cookies. Gaps remain:

• Site names. Many devices send DNS lookups to the network's resolver unencrypted unless encrypted DNS is on, and browsers usually reveal the site name when the secure connection starts unless both sides support Encrypted Client Hello.
• Traffic outside the browser. Background services, older apps and smart devices do not always encrypt, and there is no padlock to check.
• Your own clicks. If you accept a certificate warning, HTTPS can no longer help, because you have agreed to talk to whoever answered.

The last column assumes the VPN client sends DNS requests through the tunnel. To confirm that yours does, see how to test for DNS leaks.

How a VPN helps on public Wi-Fi, and its limits

A VPN closes most of the gaps in that table by routing your device's traffic, not only the browser's, through an encrypted tunnel to a VPN server. The hotel network, other guests and a fake hotspot see one encrypted connection to one server, not a list of the sites and services you use.

What a VPN does not do

• It does not make a fake login page safe: a password typed into a phishing page is simply delivered securely to the wrong place.
• It does not switch off sharing. Depending on the client, other devices on the local network may still reach your laptop; that is a job for your device's firewall and sharing settings.
• It moves trust rather than removing it. The VPN provider can see which destinations your traffic goes to, although HTTPS content stays encrypted end to end.
• It does not hide who you are from services you sign in to, and it does not replace two-factor authentication or updates.

Choosing a profile for hotel networks

On some guest networks UDP traffic is unreliable, which can make a UDP-based tunnel slow to connect or prone to dropping. Flex-VPN offers two types of profiles: AmneziaWG, based on WireGuard, which runs over UDP and is the quick, simple starting point, and VLESS + Reality, which runs over TCP with TLS and looks like ordinary HTTPS traffic. If one will not connect or keeps disconnecting on a particular network, try the other; AmneziaWG vs VLESS + Reality explains the differences.

Settings to change on iPhone, Android and laptops

A few system settings do more for public Wi-Fi security than any single app. Menu names vary by version, so look in your Wi-Fi, network and sharing settings.

iPhone and iPad

• Keep the private Wi-Fi address option on, so your device does not show the same hardware address on every network.
• Turn off auto-join for hotel and airport networks, or forget them when you leave.
• Set AirDrop to receive from contacts only, or turn receiving off.
• Set up your VPN app before the trip; the iPhone VPN guide covers profiles and common errors.

Android

• Keep the randomized MAC address setting on; recent Android versions enable it by default.
• Turn off automatic connection to open networks and forget hotspots you no longer need.
• If your VPN app supports it, enable always-on VPN in the system VPN settings and, where offered, the option that stops apps from connecting without the VPN, so nothing leaks while the tunnel reconnects.

Windows and macOS laptops

• On Windows, use the Public network profile for hotel and airport networks; it turns off network discovery and file sharing by default.
• On macOS, turn on the built-in firewall and switch off file sharing, screen sharing and other sharing services you do not need on the road.
• Stop local development servers, media servers and remote desktop listeners before joining a guest network.

If one app genuinely needs the local network, for example to cast to the in-room TV, split tunneling can keep just that app outside the tunnel. Anything you exclude is visible to the hotel network again, so keep the list short.

Travel security checklist for hotels and airports

Before you leave

1. Update your phone, laptop, browser and apps while you are on a network you trust.
2. Turn on two-factor authentication for email, banking and work accounts, ideally with an authenticator app, since text messages may not arrive while you travel.
3. Install your VPN apps and import a separate profile on each device. A Flex-VPN base plan covers three devices, so a phone, laptop and tablet can each have their own key; apps are on the download page.
4. Test the connection at home, including switching between profile types, so you are not troubleshooting in a hotel lobby.

At the hotel or airport

• Confirm the network name, give the portal only what it needs, then connect the VPN.
• Switch to your phone's mobile hotspot for sensitive tasks if the Wi-Fi seems unreliable or suspicious.
• Avoid lobby and business-center computers for anything that requires a login.
• Follow local laws and the network's terms of use.

When you check out

• Forget the hotel and airport networks so your devices do not auto-join look-alikes later.
• Sign out of any accounts you used on shared screens, such as an in-room smart TV.