Culvert VPNAirport and café Wi-Fi: is a VPN enough?
A VPN covers most of what airport and café Wi-Fi exposes, but not the sign-in page, a fake hotspot or a phishing screen. What it does and does not do.
A VPN is enough for the part of airport and café Wi-Fi that most people worry about: it hides which sites you use and what you send from the network and from everyone else on it. It is not enough for the part before the tunnel is up, which is joining the right network and getting through the sign-in page, and it does nothing about a convincing fake page that asks for a password. The realistic routine is to join the venue's named network, accept the page, connect the VPN, then get on with things.
What these networks have in common
Airport and café hotspots are open networks in the strict sense: no password, so the radio link between your phone and the router is not encrypted. Anyone in range with ordinary software can record it. They are run by a third party, often a contractor, whose equipment sees every connection your phone makes. And they use a captive portal, a sign-in page that must be accepted before any traffic is allowed through.
None of that makes them dangerous in the way old articles suggest. HTTPS means the contents of your banking session or email are encrypted before they leave the phone. What the network and its other users can see is the list of sites and services you connect to, the timing, and anything still sent over plain HTTP. The public Wi-Fi risks post has the full picture.
What a VPN covers here
Once connected, a VPN turns everything into one encrypted stream to one server. On an open airport network that closes every gap HTTPS leaves:
| Exposure on open Wi-Fi | Covered by HTTPS alone? | Covered with a VPN? |
|---|---|---|
| Page contents and passwords | Yes | Yes |
| Names of the sites you visit | No | Yes |
| DNS lookups | No | Yes |
| Plain HTTP content, including some app traffic | No | Yes |
| Which apps are active and when | No | Mostly; the network sees one stream |
| Your IP address as seen by websites | No | Yes, they see the VPN server's |
The DNS row deserves attention on a shared network. Without a VPN your phone asks the airport's resolver for every site name, and the airport's resolver, or anyone impersonating it, answers. Inside a VPN tunnel the lookups go to the VPN server's resolver instead, and the network never sees them.
What a VPN does not cover
The sign-in page. A captive portal blocks all traffic until accepted, including the VPN's own connection. On Android, the "Block connections without VPN" setting can stop the portal from loading, since the portal is exactly the kind of outside-the-tunnel connection it exists to block. Switch the setting off for a moment, accept the page, and turn it back on. The captive portal post walks through it.
The wrong network. Airports have several hotspot names in range, and some are not the airport's. A phone that joins a look-alike hands its traffic to whoever runs it. The VPN, once up, protects that traffic, but anything you did on the fake portal before connecting is exposed. The fake hotspot post covers how to spot one.
Phishing. A page that looks like your airline and asks for your login is a social problem, not a network one. A VPN carries it faithfully.
An old phone. Known flaws in an outdated browser or Android build are reachable over any network. Updates matter more than the VPN.
Why the VPN may take a moment to connect
Airport and café networks are often configured to allow only web traffic, which means TCP on ports 80 and 443. The quickest VPN protocol, WireGuard, uses UDP, and a network that drops UDP simply never answers its handshake.
A well-built app expects this. It tries WireGuard over UDP on more than one port, then a TLS-wrapped transport on TCP port 443 that looks to the network like an ordinary HTTPS connection, then IKEv2 as a final attempt, and keeps the first method that carries traffic. Each attempt has a short budget, so the whole sequence takes well under a minute. If it settles on the TCP transport, expect a little less throughput than WireGuard would give, which on airport bandwidth is rarely noticeable.
The routine, in order
- Join the network the airport or café actually names on its signage, and ask if two names look similar.
- Accept the sign-in page from the Android notification or a browser. Toggle "Block connections without VPN" off briefly if the page will not load.
- Connect the VPN and wait for it to confirm, ideally by showing an exit IP that belongs to the VPN server.
- Only then open email, banking or anything with a login.
- When you leave, forget the network so the phone does not rejoin something with the same name elsewhere.
If you have mobile data and a reasonable plan, the hotspot comparison post makes the case that skipping the airport Wi-Fi entirely is often the simpler choice.
Culvert VPN connects on airport and café networks by trying several methods automatically and shows the exit IP it verified through the tunnel, so you can see that step three actually worked, and it is on Google Play.
Questions people also ask
Should I connect the VPN before or after the airport sign-in page?
After. The sign-in page has to load before any internet traffic is allowed, and a VPN cannot connect until it does. Accept the page, then connect the VPN, then open anything else.
Are airport networks worse than café networks?
Not inherently. Both are open, shared and run by a third party. Airports have more strangers and more look-alike hotspot names in range; cafés are smaller but often run on an old router nobody maintains.
Is mobile data a better choice at an airport?
Usually yes, if you have a signal and an affordable plan. The carrier link is encrypted for you individually, which a public hotspot is not, and there is no sign-in page.