Do You Need a VPN on Airport Wi-Fi? The Important Part Is When You Turn It On

The airline had given me twelve minutes to pay an €86 fare difference.

My original flight had been cancelled. The replacement would get me home that evening, but only if I completed the payment before the offer expired. My travel eSIM had stopped passing data, so I opened the airport Wi-Fi list.

Two networks appeared near the top:

Airport_Free_WiFi

Airport_Free_WiFi_5G

Neither asked for a password. Both showed full signal.

I chose the first and waited for the login page. A white screen appeared with the airport’s logo, followed by fields for my name and email address. It looked plausible. So did the second network.

That was the moment I stopped.

I had gone online to answer a practical question: how quickly could I save the new flight? Instead, I found myself asking another one: did I need a VPN before entering payment details on airport Wi-Fi?

My first instinct was to turn on the established VPN already installed on my phone. The app connected, but the airport login page disappeared. The airline site would not load either.

I disconnected the VPN and tried again. The portal returned immediately.

The network had not failed. I had started the protection in the wrong order.

First, Make Sure the Wi-Fi Belongs to the Airport

Airport Wi-Fi is not automatically unsafe. Most websites and apps now use HTTPS encryption, which is why the US Federal Trade Commission says public Wi-Fi is generally safer than it once was. Information sent to a legitimate encrypted website is not simply exposed to everyone sharing the terminal network. (FTC guidance)

The more immediate question is whether the hotspot itself is legitimate.

In 2025, an Australian man was jailed after creating “evil twin” Wi-Fi networks that imitated legitimate services at airports and on domestic flights. Australian Federal Police said the fake hotspots were used to capture personal information and gain access to online accounts. (AFP case report) The attack worked because the network names looked familiar enough to attract travelers in a hurry.

That possibility felt less theoretical while I was staring at two almost identical options.

I walked to the information desk and asked which network was official. The agent pointed to a small sign beside the airport map. The correct name included a hyphen I had overlooked.

The network I had selected was not the one on the sign.

I removed it from my saved networks and joined the correct hotspot. That thirty-second check mattered more than anything I could have changed inside a VPN app. Security guidance recommends confirming a public network’s exact name with the organization providing it before connecting. (CISA guidance) A VPN can encrypt a connection, but it cannot make a fraudulent login page trustworthy.

The official portal asked me to accept its terms. Once I did, the airport homepage opened.

Now the network had been verified and the captive portal was complete. This was the point at which a VPN became useful.

Why the Familiar Option Became a Delay

The established provider on my phone was the reasonable first choice. It had years of public history, a large support operation and servers in more countries than I was ever likely to visit.

But an app update had signed me out.

I entered my email address and password. The service then sent a verification code to my inbox. To retrieve it, I would have to open email over the airport connection before the VPN could protect the rest of the session.

HTTPS still protected the email connection, but the login sequence defeated the reason I had opened the VPN in the first place. I was being asked to connect to an unfamiliar network, identify myself through another account and complete several recovery steps before reaching the airline payment page.

The timer showed eight minutes.

I could have continued. After signing in, I could have searched through the server list, chosen a location and adjusted the protocol if the first attempt failed.

None of that was unreasonable. It was simply too much distance between me and the task.

Travelers often describe the same smaller frustration with airport Wi-Fi: the device appears connected, yet the captive portal or VPN must be restarted several times before normal browsing begins. (brief user discussion) The lesson was straightforward. On a network built around a temporary login page, every extra setup step creates another place for the connection to stall.

I no longer needed the provider with the most impressive map. I needed the shortest reliable route from verified airport Wi-Fi to an encrypted session.

The App That Did Not Ask Me to Identify Myself Again

I had installed OnlyDogs VPN before the trip. I had not made it my default.

The service has fewer locations than the established provider, a shorter public history and far fewer independent ratings. Those were valid reasons to treat it as a backup.

At the gate, one difference mattered more: basic use did not require another conventional email-and-password account.

I opened the smaller app, selected the public Wi-Fi travel preset and connected.

The airline page loaded.

I returned to the replacement-flight offer. The passenger details were still there. I entered the card information, approved the payment in my banking app and watched the screen change from Processing to Confirmed.

A new boarding pass appeared with three minutes left.

That was the answer to the question I had actually been asking.

I did not need a VPN merely because the words “airport Wi-Fi” appeared on my screen. I needed one because I was moving between an unfamiliar shared network, an airline account and a payment service—and I wanted the session protected before the fare disappeared.

The smaller app reached that point without another registration process standing in the way.

What the VPN Changed—and What It Could Not

Once connected, the service encrypted traffic between my phone and its VPN endpoint. The airport network could still see that my device was connected, but it had less visibility into the destinations and activity passing through the tunnel. The protection also applied beyond a single browser tab.

HTTPS and a VPN cover different parts of the problem. HTTPS secures the connection to a legitimate website or app. A VPN adds an encrypted layer around the device’s network traffic, which is useful on a shared network that I do not control.

Neither protects someone who voluntarily enters credentials into a convincing fake page. That is why verifying the hotspot had to come first.

I could not inspect the airport network’s internal configuration or determine whether anyone was monitoring it. I did not need proof of an active attacker to avoid making an urgent payment directly over an unfamiliar local network.

The useful sequence was simple:

Verify the hotspot. Complete the captive portal. Turn on the VPN. Then open the sensitive service.

The order was the security feature I had nearly missed.

The Counter I Noticed After the Flight Was Safe

Once the new boarding pass was stored in my wallet, I opened the airline’s disruption page to check the baggage arrangements.

A counter inside the VPN app had begun recording blocked advertising and tracking requests. It continued rising as I moved between the airline site and a travel-information page.

Research into public Wi-Fi portals has found that many collect identifying information through registration forms or social logins and connect to third-party tracking services. A study of 67 hotspots found tracking technologies on nearly all the portals examined, including some that activated before users accepted the terms. (academic research)

The VPN could not change the information requested by the captive portal because that step had already happened. Once the tunnel was active, however, the blocking counter showed that fewer unnecessary requests were leaving the phone during the rest of the session.

It was not the reason I had opened the app. The confirmed flight was.

But it gave me another reason to keep the backup installed after I reached home.

So, Do You Need a VPN at the Airport?

For checking the weather or reading an encrypted news site on a verified airport network, HTTPS may be enough for the task.

The calculation changes when the next few minutes involve work email, cloud files, banking, passport information or a payment that cannot wait. In those situations, a VPN adds a useful layer between the device and the local network—but only after the hotspot has been verified and the captive portal completed.

Starting the VPN too early can prevent the portal from loading. Starting it after sensitive work has begun misses the moment when it is most useful. A service that requires several login and recovery steps can also turn protection into another airport delay.

The established provider offered the longer record, the larger support operation and the broader server network. The smaller service offered fewer locations, but it let me move from verified airport Wi-Fi to an encrypted connection without creating or recovering another account.

At that gate, the better airport VPN was not the one with the most countries. It was the one I could switch on before the fare disappeared.