Culvert VPNPhone hotspot or public Wi-Fi: which is safer?
A phone hotspot is usually safer than public Wi-Fi: you control it and the carrier link is encrypted per device. When to use each, and where a VPN fits.
A phone hotspot is usually the safer choice. You control the network, you set the password, nobody else is on it unless you let them, and the link from your phone to the carrier is encrypted for your device individually. Public Wi-Fi is shared with strangers, run by someone you do not know, and often open with no encryption on the radio link at all. The trade is data cost, battery and signal: where you have those, the hotspot wins; where you do not, public Wi-Fi with a VPN is the next best thing.
What makes a hotspot safer
Three properties, none of them subtle.
You are the operator. On public Wi-Fi the venue's router sees every connection your phone makes. On a hotspot, the router is your phone. There is no third party between the device and the carrier.
The radio link is yours. A hotspot with a password uses WPA2 or WPA3, which encrypts the link between each device and the phone with a key derived from that password. An open café network encrypts nothing over the air. A password-protected café network encrypts, but with a password everyone in the room knows.
There is no sign-in page. No captive portal means no fake portal, no expired session the next morning, and no moment where you are connected to a network but the VPN cannot start. The captive portal post explains why that moment is the least protected one on public Wi-Fi.
What a hotspot does not change
A hotspot moves the network you trust from the café to your carrier. The carrier still sees the outside of every connection: which servers your phone contacts, when, and how much data moves. That is the same visibility an ISP has at home, and the ISP visibility post covers it. Websites still see your carrier-assigned address.
A hotspot also does nothing about the device that is tethered to it. A laptop with an old browser is as exposed on your hotspot as on any network, because the risk is in the browser, not the link.
So a VPN still has a job on a hotspot: it hides the destinations of your traffic from the carrier and gives sites the VPN server's address. On mobile data a VPN behaves slightly differently from Wi-Fi, mostly around address changes as the phone moves between cells, and the VPN on mobile data post goes into that.
Side by side
| Phone hotspot | Public Wi-Fi | Public Wi-Fi with a VPN | |
|---|---|---|---|
| Who runs the network | You | The venue or a contractor | The venue, but it sees one encrypted stream |
| Who else is on it | Nobody you did not admit | Everyone in range | Everyone in range, but they see one encrypted stream |
| Radio link encryption | WPA2 or WPA3 with your password | Often none | Often none; the VPN encrypts inside it |
| Sign-in page | None | Usually | Usually, and it must be accepted before the VPN connects |
| Fake network risk | Low; you know your own hotspot's name | Real | Real, before the tunnel is up |
| Who sees your destinations | Your carrier | The venue, other users, the venue's ISP | The VPN provider only |
| Cost | Your data plan | Usually free | Usually free |
| Battery | High | Low | Low |
| Speed | Depends on cell signal | Depends on the venue | Slightly less than the venue's Wi-Fi |
The last column is the honest answer to "is public Wi-Fi with a VPN as good as a hotspot". It is close on privacy once the tunnel is up. It is not equivalent in the first minute, and it depends on the venue allowing the VPN to connect at all.
When the hotspot is the wrong choice
Roaming. Abroad, mobile data can cost enough that a day of hotspot use is a real bill. Public Wi-Fi with a VPN is the sensible default until you have a local plan.
Weak signal. A hotspot on one bar of signal is slower than most hotel Wi-Fi and drains the battery quickest, since the radio works hardest when the signal is poor.
Data caps. A laptop on a hotspot will happily download an operating-system update over your mobile plan. Set the hotspot as a metered connection on the laptop, or keep it for phone-only use.
Long sessions. A phone running a hotspot for hours gets warm and loses charge quickly. Plug it in, or accept that it is a short-session tool.
Setting up the hotspot so it stays safe
- Use a password of at least twelve characters and WPA2 or WPA3, never open.
- Give it a name that does not identify you, since the name is visible to everyone in range.
- Turn it off when you are done, so it is not advertising itself in your pocket.
- On Android, Settings shows how many devices are connected; if the number is higher than you expect, change the password.
Using both at once
There is nothing wrong with running a VPN on the phone that is also providing the hotspot. On Android, a VPN protects the phone's own traffic; the tethered devices' traffic goes out over the mobile connection directly and is not carried through the phone's VPN. If the laptop needs a VPN, it needs its own.
Culvert VPN works on mobile data and on any Wi-Fi, tries several connection methods on public networks that filter traffic, and shows the exit IP it verified through the tunnel so you can tell the two situations apart, on Google Play.
Questions people also ask
Do I still need a VPN on my own hotspot?
Not for protection from the local network, since you are the local network. A VPN still hides which sites you visit from the mobile carrier and gives websites the VPN server's address instead of yours.
Can someone join my hotspot?
Only with the password, if you set one and use WPA2 or WPA3. Leave it open, or use a short password, and it is public Wi-Fi that you are paying for.
Does a hotspot use more battery than Wi-Fi?
Yes, noticeably, because the phone runs both the mobile radio and a Wi-Fi access point at once. Plug in if you plan to use it for more than a short session.