We would like to count page views and clicks with Google Analytics, which sets cookies in your
browser. It is how we learn which pages are worth writing. Nothing loads until you choose, and
declining costs you nothing on this site. What we collect.
Most public WiFi advice is a decade out of date. The classic scare — a stranger in the corner reading your passwords out of the air — was largely solved by HTTPS, which now covers almost everything you do. What a VPN still fixes on an untrusted network is narrower and worth understanding before you pay for one, and it changes which features actually matter.
Proton VPN78 The best combination of the two things this page weighs most: a kill switch that handles captive portals properly, and per-network auto-connect rules on both mobile platforms.
Windscribe67 The best-scoring VPN app in our current App Store analysis, which on this page counts for more than it does anywhere else — reconnection after a dropped access point is exactly what review complaints expose.
Mullvad67 The pick when the network you are on is the thing you distrust most.
Swiss, non-profit-controlled, open source, with the only free tier worth using.
78
Owner
Proton Foundation
Jurisdiction
Switzerland · Outside the alliances
No-logs audit
None — apps audited by Securitum, 2025
Price
from $4.49/mo
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
The best combination of the two things this page weighs most: a kill switch that handles captive portals properly, and per-network auto-connect rules on both mobile platforms. It is also the only pick with a free tier that has no data cap at all, so the app can stay on a phone that travels twice a year without costing anything, and it is open source and audited if you want to check that claim.
The free tier is limited to a handful of countries and one device, and Secure Core routing is slow enough that you will notice it on hotel bandwidth.
App quality
68
Privacy & trust
73
Features
98
Price & renewal
77
Controlled by a Swiss non-profit foundation since 2024
All apps open source and independently audited
Free tier with no data cap and no ads
Renewal is higher than the intro price
Free tier cannot choose a country
Speeds trail NordVPN and ExpressVPN in most tests
Lab test pending — scored on public dataiOS app score 68/100 from 101,311 ratingsFull reviewVisit Proton VPN
Canadian, founder-owned, with a generous free tier and unusually flexible pricing.
67
Owner
Windscribe Limited
Jurisdiction
Canada · Five Eyes
No-logs audit
None found
Price
from $5.75/mo
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
The best-scoring VPN app in our current App Store analysis, which on this page counts for more than it does anywhere else — reconnection after a dropped access point is exactly what review complaints expose. Unlimited devices covers everyone in a family on one plan, and 10 GB a month free is enough for a fortnight of airport and hotel use.
Canada is Five Eyes, there is no published no-logs audit, and support is ticket-only when a network refuses to cooperate.
Flat €5 a month, no email required, accepts cash; the privacy benchmark.
67
Owner
Amagicom AB
Jurisdiction
Sweden · Fourteen Eyes
No-logs audit
None — apps audited by Cure53, 2024
Price
from $5.40/mo
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
The pick when the network you are on is the thing you distrust most. It has the strictest kill switch here, blocks local network access by default so nothing else on the hotel WiFi can reach your laptop, and its account is a number rather than an identity — nothing about the connection ties back to you even if the network operator is logging.
No free tier, five devices, and no live chat. It also declines to help with streaming, which many people want from a hotel.
App quality
63
Privacy & trust
65
Features
76
Price & renewal
83
Account is a random number, no email or name
Same price forever, no intro-vs-renewal games
Accepts cash by post and Monero
Streaming unblocking is unreliable by design
Port forwarding removed in 2023
Smaller server network
Lab test pending — scored on public dataiOS app score 63/100 from 1,441 ratingsFull reviewVisit Mullvad
Malaysia-based with a real free tier and no-logs audits; lesser known, decent value.
71
Owner
eVenture Ltd
Jurisdiction
Malaysia · Outside the alliances
No-logs audit
Securitum, 2023
Price
from $2.69/mo · renewal price unconfirmed
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
The most capable free tier for someone who only wants this on trips: no registration at all, so nothing identifies you to the provider either, plus a published Securitum no-logs audit and multi-hop on the paid plan. Ten devices at $59.95 a year if the free plan runs short.
A Malaysian company that publishes little about its ownership, and the long-plan renewal price is unconfirmed, so we do not score its true cost.
App quality
62
Privacy & trust
74
Features
81
Price & renewal
67
Free tier with no registration
Securitum no-logs audit
Port forwarding and multi-hop included
Smaller brand with fewer independent tests
Long-plan renewal price not confirmed
Ownership detail is thin
Lab test pending — scored on public dataiOS app score 62/100 from 7,560 ratingsFull reviewVisit hide.me
The biggest network and the most features; renews at nearly triple the intro price.
70
Owner
Nord Security
Jurisdiction
Panama · Outside the alliances
No-logs audit
Deloitte, 2024 (report not public)
Price
from $3.39/mo · ~$7.53/mo over 3 yrs after renewal
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
The most reliable auto-connect implementation of the major providers, with per-network trust rules and Threat Protection blocking malicious domains at the resolver — useful on networks that run their own DNS. If you already pay for it, nothing on this page is a reason to switch.
Closed source, ten devices, and the renewal is roughly three times the intro price. See the alternatives page before the second invoice.
App quality
58
Privacy & trust
65
Features
91
Price & renewal
62
Largest server network in the market
NordLynx (WireGuard) is consistently fast
Four Deloitte no-logs audits since 2018
Two-year plan renews at roughly 3× the intro price
Sibling brand Surfshark is presented as a competitor
No port forwarding
Lab test pending — scored on public dataiOS app score 58/100 from 699,424 ratingsFull reviewVisit NordVPN
Named after the exact use case on this page, and the one we would least recommend for it: a US owner with an advertising history, a proprietary protocol nobody outside the company can inspect, and no independent no-logs audit.
A generous free tier, but no audit and no obfuscation, and its app has the weakest reconnection record of the free options we track. On a network that drops every few minutes that is the wrong trade.
What we weighed for public WiFi, and the exact weights
Kill switch that survives a captive portal
Hotel and airport networks hold you on a sign-in page before letting you out. A VPN has to cope with that sequence without either blocking the portal forever or leaking traffic while the portal is open.
Auto-connect on untrusted networks
A VPN you have to remember to switch on in a queue at the gate is a VPN that is off when it matters. The apps worth having connect themselves the moment they join a network that is not yours.
Reconnection behaviour
Public networks drop constantly as you move between access points. The failure people actually experience is not interception, it is an app that silently stays disconnected after a drop.
A free tier that is genuinely usable
For occasional travel, a free plan that stays installed and works for email and messages beats a subscription you cancel after one trip.
Weights on this page: App quality 28% · Privacy & trust 24% · Features 18% · Price & renewal 12% · Censorship bypass 6% · Speed (our tests) 5% · Streaming 4% · Support & refunds 3%. Formula.
What changed since the advice you have read
The public WiFi warning most people carry around dates from an era when logging in to a site sent your password across the network in readable text. That era ended. Browsers now mark plain HTTP as insecure, the major sites all redirect to HTTPS, and apps pin their own certificates.
So the stranger-with-a-laptop story is mostly obsolete. What remains is smaller and more mundane, and it is still worth doing something about:
The network sees your DNS lookups, so it knows which sites you visited even when it cannot read what you did there.
The network operator keeps records. Hotels, airports and chains log this, and some sell it.
Captive portals are a legitimate man in the middle. For the few minutes before you sign in, that page can do things a normal site cannot.
Other devices on the network can see yours unless something stops them.
A VPN handles all four. That is a good reason to use one. It is not the same as the reason you were given.
Which features actually matter here
Not speed, and not the server count. On a shared hotel line the bottleneck is the hotel.
What matters is whether the app is on when you need it and stays on. That means auto-connect rules that fire when you join a network you have not marked as trusted, a kill switch that closes the gap when the access point drops, and reconnection that recovers without you noticing. Our App Store analysis is unusually relevant on this page, because those failures are exactly what people write reviews about.
Local network blocking is the other feature worth knowing. It stops the other devices on the hotel WiFi from reaching yours. Mullvad does it by default; most others hide it in settings.
How to set it up so it is actually on
Join the WiFi first and complete the sign-in page before the VPN connects. Then mark the network as untrusted in the app so it connects itself next time, and turn on the kill switch and local network blocking.
Test it once at home rather than discovering a problem in an airport: our leak test shows whether DNS is going where you think, and the kill switch test times how long you are exposed when the connection drops.
When you do not need one
If you are only checking email on your phone for a few minutes, mobile data is simpler and does the job. If the network belongs to your employer, a VPN may violate their policy and will not hide you from them anyway.
And if the only thing you do on hotel WiFi is stream something you already pay for, the honest reason to use a VPN there is the library, not the security — which is a different page, and we have one for that.
iPhone app rating is far below every established provider in this catalogue
Frequently asked questions
Do I actually need a VPN on public WiFi in 2026?
Less than the advertising suggests, and not for the reason usually given. Nearly every site and app you use is HTTPS, so the network cannot read the contents of what you send. What it can still see is which sites you visit through DNS lookups and connection metadata, and what it can still do is redirect you, inject warnings into unencrypted pages, and see what devices are on the network with you. A VPN closes those, which is a real but narrower benefit than 'hackers will steal your bank password'.
What is the risk on hotel WiFi specifically?
The network operator, not a stranger with a laptop. Hotel and conference networks routinely log which sites each room visits, sometimes sell that data, and often run their own DNS resolver. Several have been caught injecting scripts into pages. A VPN moves all of that outside their view, which is why hotel WiFi is the strongest case on this page.
Should I use a free VPN on public WiFi?
A free tier from a provider whose paid product is good is fine — Proton VPN, Windscribe and hide.me all qualify. A free VPN with no paid product to fund it is not, because the traffic is the product. On an untrusted network you would be replacing one party you do not trust with another you know less about.
Why does my VPN break the hotel sign-in page?
Because the portal has to be reached before the network lets anything else out, and a strict kill switch blocks it. Connect to the WiFi first, complete the sign-in page, then let the VPN connect — good apps handle this automatically, which is one of the things this page scores.
Is mobile data safer than public WiFi?
Generally yes, and it is the simplest answer when you only need a minute of access. Your mobile carrier can still see which sites you connect to, so it is a change of who is watching rather than nobody, but a carrier has more to lose from mishandling it than a cafe router does.
Does a VPN protect me from someone stealing my laptop's files on the same network?
Only if it blocks local network access, which not all of them do. Mullvad blocks it by default; several others offer it as a setting. It is worth turning on before a conference or a hotel stay, and turning off again at home, or your printer will stop working.
