VPN on public Wi‑Fi: what the real risks are in 2026.

Blog · 19 October 2026 · 5 min

State of things on 19 October 2026: Pevnost is in private beta. The first server, prg1 in Hluboká nad Vltavou (WEDOS data centre), has been live since 18 October; a first short test measured around 300 Mbit/s. Every new account gets two free hours (one trial per connection, one device), then 120 CZK / €5 for 30 days or 1 200 CZK / €50 a year. Pay with Bitcoin on-chain (preferred), by card through Stripe or by bank transfer; Lightning is planned and Monero is coming. Windows app 0.3.1 beta, Android app 0.1.0 beta. Last reviewed 19 October 2026.

“Never use public Wi‑Fi without a VPN” was good advice fifteen years ago, when logins crossed café networks in plain text. In 2026 almost everything runs over HTTPS, and much of the fear sold with VPN subscriptions is out of date. Using a VPN on public Wi‑Fi still makes sense, but for narrower reasons. Here is what actually remains, what a VPN fixes, and what it does not.

What changed

Banks, mail, shops and social networks use HTTPS, most of them with HSTS, which tells the browser never to connect to them unencrypted. Apps validate certificates. Someone on the same network cannot read your mail or your bank session, and an ad that implies otherwise is exaggerating. A password on the café blackboard (WPA2) keeps out people on the street, not the other guests: anyone with the password can decrypt traffic they capture. Newer networks with Wi‑Fi Enhanced Open encrypt the radio link without a password, which stops passive listening but not a fake access point.

What remains

• DNS. The hotspot hands your device its own resolver. It sees every name you look up and can answer falsely, sending you to an ad page or a lookalike site.
• Metadata. Whoever runs the network, often an outsourced provider, sees which servers you contact, usually the site names in the TLS handshake, and how much you transfer. Logins by phone number or social account tie that to you.
• Captive portals. The login page is a website run by whoever runs the network. A fake one may ask for your e-mail password “to unlock the Wi‑Fi”. Never type a real password there.
• Evil twins. An attacker sets up an access point with the same name. Phones join known open names automatically. The attacker becomes your router: sees DNS and metadata, serves fake portals, tries plain-HTTP sites. Proper HTTPS holds, unless you click through a certificate warning.
• Other devices. Without client isolation, other guests can see your device and its name and probe open services such as file sharing.

What a VPN fixes

• DNS goes through the tunnel to our resolver at 10.8.0.1; the hotspot neither sees nor forges it.
• Metadata shrinks to one encrypted stream to our server.
• An evil twin cannot get inside the tunnel. WireGuard authenticates our server by the public key in your configuration; a fake access point can only pass the traffic on or block it.
• With a kill switch nothing leaves outside the tunnel while it is up, and our Windows app also blocks the local network unless you allow it (see the kill switch explained).

What a VPN does not fix

• The captive portal, which has to be completed before the tunnel can work, and anything you type into it.
• What sites learn when you log in, or malware and unpatched systems.
• Your device on the radio link: its hardware address and broadcasts. Use the private (random) Wi‑Fi address your phone or laptop offers.
• Networks that block UDP or VPNs. WireGuard is not disguised; use mobile data instead.
• Certificate warnings you click through. No VPN protects you from that.

A routine that works

1. When it matters, prefer mobile data or your phone’s hotspot.
2. Mark the network as public (Windows asks), turn off file sharing, use a random Wi‑Fi address.
3. Join, complete the portal without real passwords, then start the VPN. On Android, “Block connections without VPN” can stop the portal from loading; turn it off for the login and back on right after.
4. Check that DNS answers from 10.8.0.1 with the leak test.
5. Forget the network afterwards, so the device does not later join a twin with the same name.

A VPN on public Wi‑Fi moves your DNS and metadata from the hotspot to us. It does not make you anonymous, and it does not replace HTTPS or common sense; it closes the gaps HTTPS leaves open. What your home or mobile operator sees is in a separate post.