Every trip starts the same way: you land, the phone offers "Airport_Free_WiFi," and you tap connect without thinking. That reflex is worth breaking. It helps to know what you are actually joining, and what setup makes travel connectivity safe.
The three problems with airport (and hotel) Wi-Fi1. You do not know who runs the network. "Evil twin" hotspots (a laptop or $50 device broadcasting
next to the real
) are the oldest trick in travel hacking, and they persist because they still work. Connect to the wrong one and everything you do flows through a stranger's machine.
2. Captive portals are data collection. The login screen asking for your email, name or "accept terms" click is not just bureaucracy. Portal operators harvest emails for marketing, log device MAC addresses, and sell or share foot-traffic and browsing analytics. You are paying for "free" Wi-Fi with data.
3. Shared networks expose you to other users. Hundreds of strangers on one network means constant background noise of scanning and probing. HTTPS limits the damage, but the operator can still see your metadata: which domains you visit, when, and for how long.
The best fix: do not use itThe simplest win in travel security is remembering that
your own mobile data is a private network. With a travel eSIM, the airport's Wi-Fi has nothing to offer you, because you landed already connected.
- No captive portal, no email handover
- No shared network with strangers
- No evil twin risk (your carrier is authenticated by the SIM, not by a network name anyone can spoof)
- No speed collapse at 6pm when the terminal fills up
A
nadanada eSIM costs less than the airport coffee you bought while using their Wi-Fi, and it requires no account, no email and no ID to buy.
When you must use public Wi-Fi: the 5-step hardening1.
Verify the network name against official signage or staff. If two networks have near-identical names, treat both as hostile and use data instead.
2.
Connect, log in, then start your VPN before opening anything else. A
no-log, no-account VPN encrypts all traffic past the portal, so snoops see ciphertext to one server and nothing more. Pay-per-use means you are not subscribing to something for a layover.
3.
Avoid the crown jewels. No banking, no password entry, no primary-email logins on public Wi-Fi, even with a VPN, if you can avoid it. Save it for data.
4.
Disable auto-join. Both iPhone and Android remember public networks and will rejoin a spoofed copy automatically next time. Settings > Wi-Fi > the network > Forget/Auto-Join off.
5.
Keep AirDrop/sharing off in public. Set it to Contacts Only or off entirely.
The hotel version of the same problemHotel Wi-Fi adds two wrinkles: per-room login codes tie traffic to your room number and name, and hotel networks are among the most compromised in hospitality-industry breach reports. The same rules apply, and again, a mid-size eSIM data plan usually covers an entire trip's evenings.
The 2026 default for travelData plans are cheap enough now that "find the Wi-Fi" is an obsolete instinct. Land connected on your own eSIM, treat public Wi-Fi as a last resort, and put a VPN between yourself and any network you do not control. Do those three things and you have covered almost every realistic travel Wi-Fi risk.
FAQIs airport Wi-Fi safe to use?For casual browsing with HTTPS it is tolerable, but airport Wi-Fi has real risks: fake 'evil twin' hotspots with lookalike names, captive portals that harvest emails and device identifiers, and operators that log and monetize your browsing. Never do banking or enter passwords on public Wi-Fi without a VPN.
What is an evil twin attack?An attacker sets up a hotspot named like the legitimate one ('Airport_Free_WiFi'). Your phone connects to the attacker, who can then intercept or tamper with unencrypted traffic and serve phishing pages. It requires no skill beyond a $50 device, and airports are the classic hunting ground.
Does a VPN protect me on public Wi-Fi?Yes. A VPN encrypts everything between your device and the VPN server, so the hotspot operator, legitimate or malicious, sees only encrypted traffic to one destination. It neutralizes snooping, most evil-twin interception and captive-portal traffic logging.
Is my phone's hotspot safer than public Wi-Fi?Much safer. Your own eSIM data connection skips the shared network entirely: no other users, no captive portal, no hotspot operator logging you. If you have data, prefer it over public Wi-Fi whenever the task involves accounts, payments or anything private.
What is the safest way to connect at an airport?Ideally: use your travel eSIM data and skip airport Wi-Fi completely. If you must use the Wi-Fi: verify the exact network name with official signage or staff, use a VPN before opening any app, avoid logging into sensitive accounts, and 'forget' the network afterward.
Can airport Wi-Fi see what I do on HTTPS sites?HTTPS hides page content, but the network still sees which domains you visit, when, and how much data flows, which is enough to profile you. Many portals also require an email address that gets added to marketing databases. A VPN or your own eSIM data hides even the domain list.
