Safer than its reputation, mostly. The real risks are quieter than people expect, and five minutes of care covers most of them.
What's actually at risk
Most websites and apps now encrypt traffic with HTTPS, so someone else on the same network generally can't read your passwords or messages. The risks that remain are less dramatic: a fake network with a convincing name, a sign-in page that asks for more than it should, and the network operator being able to see which sites you visit.
Before you connect
- Confirm the exact network name with the front desk or official signs. "Hotel_Guest" and "Hotel Guest Free" may not be the same network.
- Turn off file sharing and set nearby-device sharing to contacts only.
- Make sure your phone and laptop have their latest updates.
While you're connected
- Don't install anything a Wi-Fi sign-in page asks you to install.
- For banking or work accounts, your phone's mobile hotspot is a good alternative.
- Turn on two-step sign-in for important accounts before you travel.
Where a VPN helps, and where it doesn't
A VPN encrypts everything between your device and the VPN's server, so the hotel network sees only that you're connected to a VPN. That protects you from snooping on the network and limits the damage from a lookalike hotspot.
It won't stop a phishing email, a malicious download or a weak password. Those still depend on habits and up-to-date software.