The coffee shop hacker stealing your passwords isn't really the threat anymore
The classic warning — "never log into your bank on coffee shop wifi, a hacker on the same network can see everything you type" — was accurate advice for the mid-2000s internet. It's largely outdated now, for a reason most people never got told about.
What actually changed: HTTPS became the default
Back when a meaningful share of websites still loaded over plain HTTP, anyone else on the same public wifi network really could intercept your traffic in plain text — passwords, messages, everything — with basic tools. Today, the overwhelming majority of web traffic is encrypted with HTTPS by default, including virtually every login page, bank, and major site. That encryption happens regardless of which network you're on. Someone else on the same coffee shop wifi generally cannot read HTTPS traffic between your device and the site you're using, VPN or not.
What a VPN actually does
A VPN encrypts your traffic between your device and the VPN provider's server, and routes it through that server before it goes to the wider internet. What that actually buys you:
- Hides your browsing destinations from your local network operator — the coffee shop, hotel, or airport wifi owner can see that you're connected and using data, but not which sites you're visiting, if a VPN is active
- Hides your browsing from your home ISP, similarly
- Masks your IP address / rough location from the sites you visit, showing the VPN server's location instead
What it doesn't do
- It doesn't add meaningful protection to already-encrypted HTTPS traffic — that traffic was already protected from other people on the network before the VPN got involved
- It shifts trust to the VPN provider instead of your ISP. The VPN company can now see everything your ISP used to be able to see. A VPN is only as trustworthy as the company running it — free VPNs in particular have a well-documented pattern of monetizing user data, which defeats the point
- It doesn't stop phishing, malware, or you willingly typing your password into a fake site — none of that is a network-level problem a VPN can fix
The genuinely real public wifi risks
- Rogue access points ("evil twin" networks) — a fake network named to look like the real one ("Airport_WiFi_Free"), designed to get you to connect directly to an attacker's device. Verify the network name with staff if you're unsure.
- Unencrypted HTTP traffic, which still exists on some smaller or outdated sites — check for the padlock icon, and be cautious of any site prompting a login over plain HTTP
- Devices with file sharing or auto-connect features left on, which can expose your device to others on the same local network regardless of what website you're visiting
So is a VPN worth using?
For privacy from your ISP or a network operator you don't trust, yes, that's a legitimate reason to use one — from a reputable, paid provider, not a free one funded by your data. For "protecting your passwords from hackers on public wifi" specifically, that threat model is mostly already handled by HTTPS, and a VPN isn't adding much there anymore.
Quick reference
- HTTPS encryption, on by default on almost every major site now, already protects most of what a VPN is marketed to protect
- A VPN's real value is hiding your destinations from your ISP or local network operator
- Free VPNs often monetize your data — the thing you were trying to avoid in the first place
- Evil-twin networks and unencrypted HTTP sites are the actually current public wifi risks
- A VPN doesn't stop phishing or a fake login page — that's not a network problem