Hotel Wi-Fi Security With a VPN

Hotel Wi-Fi is one of the most convenient parts of a remote worker's life, and one of the least examined. You check in, find the network name on a card by the lift, accept a terms page, and within minutes you are on a client call or logging into your bank. Few people stop to ask who else is on that network, who runs the hardware behind it, or whether the network they joined belongs to the hotel at all.

These are real risks. Hotel networks combine several features that security professionals treat as warning signs. Hundreds of short-stay, unvetted users share the same network segment. Passwords are shared or missing. Routers are often old and managed by third-party contractors. Network names are trivial to copy. A virtual private network (VPN) is software that creates an encrypted tunnel between your device and a server run by the VPN provider. It addresses most of these weaknesses, but only if you choose and configure it correctly.

This guide covers how hotel networks expose your traffic and what a VPN does and does not protect. It also explains how to compare providers on the attributes that matter, how to connect safely through a hotel login page, and the common mistakes that quietly undo your protection.

{{IMAGE_1:laptop on hotel room desk}}

How Hotel Wi-Fi Exposes Your Traffic

Hotel networks generally use one of two security models, and both are weak. The first is an open network, which has no password and no encryption between your device and the wireless access point. Anyone within radio range with free packet-capture software can record the traffic. The second is WPA2-Personal with a shared password printed on a key card. That looks more secure, but anyone who knows the password and captures the moment your device connects can, in principle, decrypt your traffic. The newer WPA3 standard fixes this weakness by giving each device its own encryption keys, but many hotels have not upgraded their equipment.

Two attack patterns are especially easy in a hotel. The first is an evil twin: a rogue hotspot that uses the same or a similar network name to the real one, such as 'Grand_Hotel_Guest' next to 'Grand Hotel Guest'. Devices often connect to whichever signal is strongest, so an attacker in the lobby or the next room can attract victims without any technical skill. The second is a man-in-the-middle attack, where the attacker sits between you and the internet and can observe, redirect or alter your traffic. An evil twin is simply the easiest way to get into that position.

A common objection is that most websites now use HTTPS, which encrypts page content between your browser and the site. That is true, and it helps. But HTTPS leaves a great deal exposed. Your DNS lookups (the requests that turn domain names into server addresses) usually travel unencrypted. The names of the sites you visit are often visible in the connection setup. Some apps handle encryption poorly. And the hotel's captive portal, the web page that asks for your room number or surname before granting access, can itself be faked. On top of that, the network operator can log every domain you visit.

What a VPN Protects (and What It Doesn't)

A properly configured VPN encrypts all traffic leaving your device, not just browser traffic, and sends it to the provider's server before it reaches the wider internet. To anyone on the hotel network, including other guests, an evil-twin operator or the hotel's own logging system, your activity looks like a single stream of encrypted data to one address. Your DNS requests travel inside the tunnel too, as long as the VPN uses its own DNS servers. Passive snooping and domain-level logging are neutralised, and an evil twin can no longer read what you are doing.

A VPN is not a complete security system, though. It does nothing against phishing emails, malicious downloads, reused passwords or a stolen laptop. It cannot protect a shared business-centre computer, which may already have keylogging software installed. It also does not stop you typing credentials into a fake captive portal before the tunnel is up. Strong unique passwords, multi-factor authentication, full-disk encryption and up-to-date operating systems remain essential.

Warning: A VPN moves trust rather than removing it. The provider's servers can see the same metadata the hotel network could have seen. Choosing a provider with a credible no-logs record therefore matters more than choosing one with the most servers. If you would rather not depend on any shared network, a mobile data hotspot is a strong alternative. Our Nomad SIM card review covers whether a travel eSIM is worth using as your primary connection.

Choosing a VPN for Hotel Use: Jurisdiction, Audits and Device Limits

Is this VPN worth using on hotel Wi-Fi?

A three-question test for whether a VPN is worth using on hotel Wi-Fi.

Q1

Is the provider's jurisdiction clear?

No

No

Look elsewhere

Jurisdiction decides what authorities can compel it to hand over

Yes

Q2

Has an independent firm audited its no-logs claim?

No

No

Treat the claim as marketing

An outside audit is what separates a promise from evidence

Yes

Q3

Does the device limit cover your laptop, phone and tablet?

No

No

Pick a higher limit or use a travel router

A router counts as a single connection

Yes

Shortlist it

Then check for a kill switch, OpenVPN over TCP 443 and obfuscation

IllustrativeA rule of thumb from the advice above. No figures shown.

Three attributes separate a trustworthy VPN from a marketing promise. The first is jurisdiction, the country whose laws govern the provider and determine what data authorities can compel it to hand over. The second is an independent no-logs audit, in which an outside accounting or security firm examines whether the provider's systems actually avoid storing user activity. The third is the simultaneous-connection limit, meaning how many of your devices can use the service at the same time.

Providers differ on all three, and the details change, so check each one's own pages before you buy. Look for a clearly stated jurisdiction, a recent no-logs audit published by an independent firm, and a connection limit that covers every device you travel with. Not all audits are equal: a Type I assessment evaluates how controls are designed at a single point in time. It is a meaningful signal, but it is narrower than a Type II audit that tests controls over an extended period.

For hotel use specifically, connection limits matter more than they first appear. A laptop, phone, tablet and e-reader quickly add up, and couples or families sharing a subscription can exhaust a low cap in a single room. Beyond those three checks, look for three features. You need a kill switch, which blocks all internet traffic if the VPN tunnel drops. You need support for both WireGuard (fast and modern) and OpenVPN over TCP port 443, which looks like ordinary web traffic and passes through restrictive networks. And you need obfuscation, also called stealth mode, for hotels that actively block VPN traffic.

Step-by-Step: Connecting Safely Through a Hotel Login Page

Hotel Wi-Fi to VPN connection routine

The safe sequence for joining a hotel network, passing the captive portal and activating VPN protection.

1. Verify network name with front desk

   Confirm exact spacing and capitalisationOn arrival

2. Join the confirmed network

   Close background sync apps firstBefore portal

3. Trigger captive portal

   Visit plain HTTP address in browserAt login page

4. Enter portal credentials only

   Room number and surname; never payment detailsAt login prompt

5. Connect VPN with kill switch enabled

   Minimise unprotected windowImmediately after portal

6. Run IP and DNS leak tests

   Verify tunnel shows VPN server and DNSAfter connection

IllustrativeA summary of the steps described above, not a measured schedule.

Captive portals create an awkward chicken-and-egg problem. The VPN cannot connect until you have logged in, but logging in means briefly using the network unprotected. The safest routine minimises that window. Follow these steps:

1. Confirm the exact network name with the front desk, including spacing and capitalisation. 2. Join that network and close any apps that sync in the background. 3. Trigger the portal by visiting a plain HTTP address in your browser. 4. Enter only the information the hotel requires, usually a room number and surname, and never a reused password. 5. Connect the VPN immediately, with the kill switch enabled. Never enter payment details on a portal page unless the hotel confirms it charges for Wi-Fi.

Once connected, check that the tunnel works. Run an IP-address check and a DNS leak test, both of which most providers offer on their websites. The results should show the VPN server's location and DNS servers, not the hotel's internet provider. When you check out, tell your devices to forget the network so they do not automatically rejoin a lookalike at your next stop. The same routine applies on the shared networks found in co-living spaces, cafés and airport lounges. Frequent travellers often add a compact travel router, which logs into the portal once and then runs the VPN for every device behind it. Each router counts as a single connection against your plan's limit.

Common Mistakes That Undo Your VPN Protection

The most common mistake is leaving the kill switch off. Hotel Wi-Fi drops frequently, and laptops often wake from sleep before the VPN reconnects. Without a kill switch, email clients, cloud-sync tools and messaging apps send data unprotected during those gaps. A related mistake is allowing a DNS or IPv6 leak. This happens when your device sends domain lookups, or traffic over the newer IPv6 protocol, outside the tunnel. Enable the provider's leak protection and run the leak test again after every app update.

The second group of mistakes involves misplaced trust. Leaving auto-join switched on lets your phone connect silently to any network that shares a familiar name. Choosing a free VPN often means accepting a provider that funds itself by collecting or selling the very data you are trying to protect. And clicking through a browser certificate warning on hotel Wi-Fi is a classic sign of a man-in-the-middle attempt. If a well-known site suddenly shows a security warning, disconnect rather than proceed.

Finally, many travellers protect the laptop and forget the rest. Phones handle banking, two-factor codes and work messaging, and they join hotel Wi-Fi just as readily. Install the VPN on every device that touches the network, set it to connect automatically on untrusted networks, and treat the hotel's business-centre computers and lobby smart TVs as public terminals. Never sign into personal accounts on them.

When the Hotel Network Blocks or Throttles Your VPN

Some hotel networks block VPN traffic. This can be a deliberate policy, a side effect of aggressive content filtering, or a requirement in countries that restrict VPN use. Symptoms include the VPN app hanging on 'connecting', connecting but loading nothing, or speeds collapsing to a fraction of the unprotected rate. Start by switching protocols. If WireGuard fails, try OpenVPN over TCP port 443, then enable obfuscated servers if your provider offers them. Trying a server in a nearby country often helps with speed as well.

Warning: VPN legality varies by country. A small number of governments restrict or license VPN services, and tolerated use for personal privacy is not the same as explicit legal permission. Check the current rules for your destination before you travel, and check your employer's policy too. Some companies require their own corporate VPN and prohibit running consumer VPNs alongside it.

If nothing gets through, the most reliable fallback is your own mobile data, either from a local SIM or a travel eSIM shared as a hotspot. Cellular connections are encrypted between your device and the mast and are not shared with other guests. That makes them a sensible choice for sensitive work, even when the hotel network is technically usable. Keep a modest data allowance in reserve for exactly these situations.

Hotel Wi-Fi is not inherently dangerous, but it is inherently untrustworthy. It is shared, frequently unencrypted, easy to impersonate and run by people you will never meet. A reputable VPN with an independent no-logs audit, enough simultaneous connections for all your devices and a kill switch that is actually turned on closes most of the gaps. Pairing it with a disciplined captive-portal routine closes most of the rest.

Treat the VPN as one layer of protection rather than the whole defence. Combine it with multi-factor authentication, updated devices and a mobile-data fallback, and the hotel network becomes what it should be: a convenient pipe to the internet that cannot see what you send through it.