Quick verdict: Proton Free is my first choice for an occasional hotspot connection on one device. ExpressVPN is a paid alternative for straightforward setup, NordVPN suits ten connections with optional desktop tools, and Surfshark suits many paid devices. HTTPS already protects most web traffic; a VPN adds network privacy rather than making every hotspot or website safe.
This guide ranks four options for cafés, hotels and airports by the job they solve. Start with a no-cost tunnel if it meets your need, then consider a paid service for easier setup, your device count or specific controls. The connection sequence below matters as much as the subscription.
Ranked shortlist: match the VPN to your need
- Proton VPN: a no-cost one-device tunnel.
- ExpressVPN: straightforward paid setup.
- NordVPN: ten connections and optional desktop tools.
- Surfshark: many devices on a paid subscription.
Compare the practical Wi-Fi choices
I put an ongoing free one-device option first, straightforward paid setup second, ten-device desktop-tool flexibility third, and unlimited paid-device coverage fourth. This is a practical recommendation order, not a new speed or leak-test leaderboard. Four distinct choices are enough for this task.
Scroll horizontally to see all columns.
| Product | Pricing (devices/users) | Main capabilities |
|---|---|---|
 Proton VPNFull review | Free: 1 connection, unlimited data. VPN Plus: 10 connections; paid price and renewal depend on the current offer. View plans | Free VPN; Plus adds paid server selection, Secure Core multi-hop and NetShield DNS filtering. |
 ExpressVPNFull review | US Basic offer: $83.72 for 28 months; listed renewal $99.95/year; 10 simultaneous devices. Advanced/Pro are different bundles. Check pricing | Consumer VPN; plan-dependent security extras. |
 NordVPNFull review | Paid VPN: up to 10 simultaneous devices. Introductory totals, local currency and annual renewal vary by offer. View plans | Consumer VPN; higher bundles add separate products/features. |
 SurfsharkFull review | Paid VPN: unlimited simultaneous devices. Starter is the VPN-focused tier; One and One+ are separate bundles. Compare current initial total and annual renewal. View plans | Consumer VPN with separate One/One+ security bundles. |
What HTTPS and a VPN each protect
The FTC explains that public Wi-Fi is usually safe today because most websites encrypt connections. HTTPS protects the data exchanged with the website, including login details in transit. Never dismiss a certificate warning simply to make hotel Wi-Fi work.
A full-device VPN adds an encrypted tunnel from the device to its VPN server. It can hide routed destination traffic from the local network or ISP and changes the outward IP seen by websites. The VPN provider becomes another party you trust, and activity outside the tunnel does not receive that protection.
Neither layer makes the receiving website honest. A fake shop can use HTTPS, take your payment and steal the information you willingly provide. A VPN also does not patch a vulnerable device, revoke an unsafe app permission or restore an account already compromised.
For covered traffic, the VPN tunnel runs from your device to the VPN server. HTTPS separately protects web content to the website. Accounts, cookies and information you submit can still identify you; an excluded app bypasses the VPN tunnel.
What earns a place on this shortlist
The comparison is based on official product, plan and support documentation checked on 6 October 2026. It adds no new measured leak, throughput, streaming or hotspot test results. Choices are based on free versus paid access, relevant device limits, app controls and the cost of staying subscribed.
Choose an app for the operating system you will actually carry. A laptop-only protection feature is not evidence that an iPhone receives the same protection. A browser extension likewise does not automatically tunnel email, cloud backup or other apps.
1. Proton VPN — my no-cost hotspot choice
Proton Free provides one connection and unlimited data. It is an ongoing free plan, making it a useful starting point for occasional hotspot use without a multi-year commitment.
Server choice and paid features are more limited than on VPN Plus. Plus provides ten connections and extras such as Secure Core and NetShield; those extras are separate from the basic decision to add a VPN tunnel.
Try the free app on your actual phone or laptop, including wake-up and network changes. Upgrade for a specific need such as server choice or additional devices, rather than assuming free protection is automatically inadequate.
Official Proton VPN product or support details
2. ExpressVPN — a paid option for straightforward setup
Basic, Advanced and Pro allow 10, 12 and 14 simultaneous devices. If you only need the VPN on a laptop and phone, start by comparing Basic; paying for a bigger bundle does not make the café itself trustworthy.
Check the kill-switch and automatic-connection behaviour in the actual app. A blocked captive portal can require a short, deliberate disconnect before login, followed by reconnection. Do not leave confidential work running during that interval.
The US Basic offer checked on 6 October was $83.72 for 28 initial months, then $99.95 per 12-month renewal. Buy only if that commitment and the current eligible refund terms suit your use.
Official ExpressVPN product or support details For a fuller assessment, read our ExpressVPN review.
3. NordVPN — ten connections and optional desktop tools
NordVPN’s ten simultaneous connections cover a practical laptop-and-phone setup without buying the biggest bundle. Its DNS-based scam and phishing filtering is separate from the advanced desktop scanner.
Scam, phishing, and malware protection, formerly Threat Protection Pro, supports Windows 10/11 and the sideloaded macOS app on macOS 12 or later. An iPhone, Android phone, Linux machine or Mac App Store install does not receive the same scanning feature.
Choose the locally offered plan by included features and renewal total. Paying for storage, identity services or antivirus solely because you use hotel Wi-Fi can create unnecessary ongoing cost.
Official NordVPN product or support details For a fuller assessment, read our NordVPN review.
4. Surfshark — many paid devices, with a smaller trial limit
A paid Surfshark VPN subscription has unlimited simultaneous devices. Starter supplies the VPN; One and One+ add other products that are not required simply to use airport Wi-Fi.
The current eligible website trial lasts seven days and is limited to three devices while trialling. It applies to selected 12- or 24-month plans and supported payment methods, then converts to a paid subscription unless cancelled. Check the charge date before enrolling.
Keep split-tunnel exclusions narrow. Surfshark Bypasser supports app-dependent controls, but iOS excludes websites rather than arbitrary apps. Traffic you exclude does not gain protection from the VPN tunnel.
Official Surfshark product or support details For a fuller assessment, read our Surfshark review.
A practical hotel or café connection sequence
Before travelling: install the official app, sign in and test it on a known network. Update the app, browser and operating system. Enable multifactor authentication on important accounts and have a mobile-data fallback.
At the venue: ask staff for the exact network name and portal process. Avoid similarly named networks and do not install a certificate or configuration profile from an unexpected portal. A familiar-looking name is not authentication.
Complete the captive portal: if the VPN or its blocking mode prevents the portal loading, pause confidential activity, deliberately disconnect only long enough to complete the expected venue login, then reconnect. Do not disable HTTPS checks or endpoint security.
Before working: confirm the VPN reports a connection and the visible outward IP has changed. Check the kill switch’s intended mode. If you must exclude a browser or app to reach a service, remember that its traffic bypasses the tunnel.
When finished: disconnect from the venue network, forget it if you will not use it again and disable unwanted automatic joining. Keep Bluetooth and file sharing appropriate to the environment.
When the VPN or site will not work
If nothing loads, first establish whether the venue internet connection works after the normal portal login. Change to a nearby VPN endpoint or another supported protocol rather than repeatedly changing unrelated settings.
For a banking site that rejects a shared VPN IP, a trusted mobile-data connection may be the more useful fallback. If you intentionally disconnect the VPN, close unrelated traffic and use HTTPS; do not interpret the bank’s block as evidence that the VPN has failed to encrypt.
For an employer-managed laptop, follow its required corporate VPN and network policy. Running another consumer tunnel can conflict with access controls. If a hotspot blocks VPN use, a personal hotspot or trusted connection is preferable to defeating the device’s security settings.
A larger server network cannot repair congested café bandwidth. Compare baseline and VPN performance using the same task, device and time; record the endpoint and repeat after reconnecting. The result applies to that setup, not every airport or hotel.
Avoid paying for a trip you can cover another way
For occasional one-device use, consider Proton Free first. For a short trip, compare a monthly total with the entire upfront cost of a longer promotion. For several devices, distinguish installed devices, simultaneous connections and logged-in slots.
A phone hotspot can be a practical alternative when your mobile tariff and roaming rules allow it. Budget for data and local restrictions. Neither a paid VPN nor a mobile connection excuses phishing, unsafe downloads or weak account recovery.
Final recommendation
Start with HTTPS, an updated device and the expected hotspot login. Choose Proton Free when a no-cost one-device tunnel is enough; compare ExpressVPN for paid setup, NordVPN for ten connections and desktop extras, or Surfshark for many paid devices. Pay for a specific benefit rather than a promise that Wi-Fi becomes risk-free.
Frequently Asked Questions
Do I need a VPN for every public Wi-Fi visit?
No. HTTPS already protects most website traffic in transit. A VPN can add network privacy, but whether it is useful depends on your traffic, device and risk.
Will a VPN make a fake hotspot safe?
No. It cannot validate the hotspot operator, make a phishing portal honest or repair a compromised device.
What if the hotel login portal is blocked?
Pause sensitive work, deliberately disconnect only for the expected portal login, then reconnect and check protection before continuing. Do not ignore certificate warnings or install unexpected profiles.
Can I use a free VPN on café Wi-Fi?
Proton Free provides unlimited data for one connection. Its server-selection and paid-feature limits still apply.
Why does my bank reject the VPN?
Some banks block shared VPN addresses. A trusted mobile connection can be a useful fallback; the rejection alone does not prove an encryption fault.
Does a browser VPN extension protect every app?
Usually not. It covers the supported browser traffic, while a full-device VPN app is the relevant choice for tunnelling other applications.
For the wider privacy decision, read our privacy VPN comparison. For a paid many-device option, see the Surfshark review.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.