What the tunnel actually covers on a hotel, airport or cafe network, and the three things it does nothing about.
Partly, and the part it misses is the part people worry about. A VPN encrypts everything leaving your device, so whoever runs the network sees one connection to one address instead of your browsing, and a hostile hotspot can no longer steer you to a fake page. It does nothing about the accounts you are already signed into, and nothing about an email that persuades you to type your details somewhere. The detail is below, and it is less alarming than most articles on this subject.
Most articles on this subject are still describing the internet of 2013. Being precise about what changed is the difference between useful advice and scare copy.
Ten years ago, someone sitting three tables away with the right software could read a good portion of what you sent over a cafe network. That threat has largely closed. Nearly every site now uses HTTPS, which encrypts the contents of the connection between your browser and the site. Your bank login, your email, the message you just typed: a stranger on the network cannot read any of it.
Three problems survived, and those are the ones worth designing around.
Anyone with about eighty dollars of hardware can broadcast a Wi-Fi network and give it whatever name they like. Sitting in an airport lounge, your phone shows a list of names and one of them says Free Airport WiFi. Join the wrong one and the attacker becomes the road your traffic travels on. They still cannot read your HTTPS traffic, but they decide which address your device reaches when it asks for a website, and they can serve you a login page that looks exactly like the one you were expecting.
HTTPS hides the contents of a page, not the address of it. The hotel, the shopping centre or the airline lounge can build a list of every domain your device contacted while you were connected. That is not a hacker, it is ordinary infrastructure, and it is usually logged somewhere. Whether it bothers you is a personal call, but it is worth knowing the choice exists.
When something is wrong with a connection, the browser says so. It puts up a full-page warning about a certificate. The trouble is that these warnings also appear for harmless reasons, so people learn to click through them, and by the time it matters the habit is already set.
Worth being clear about: the biggest financial losses in this age group do not come from Wi-Fi at all. They come from investment schemes, from someone phoning and claiming to be from the bank, and from romance approaches built over months. No VPN touches any of that. If you only have the energy to fix one thing this week, turn on two-factor authentication for your bank and your email instead.
Five checks, none of which need any technical knowledge. Together they take about thirty seconds.
Yes, for the part of the problem you cannot control. A VPN wraps everything leaving your device in its own layer of encryption and sends it to the provider's server before it goes anywhere else. The cafe network, the hotel portal and whoever set up that suspiciously convenient hotspot all see one encrypted stream heading to one address, with no way to read it or redirect it.
What it will not do is protect you from yourself. Type your card number into a page you reached from an email and the VPN carries that data faithfully to the scammer, encrypted the whole way. That is the honest limit of the tool, and it is why the two lists below matter as much as the recommendation.
Our pick for readers over 50 is NordVPN, and the reasoning is the audit record rather than any single feature. The full assessment, including where it is weaker than the alternatives, is in the NordVPN review. If you want to check the evidence first, is NordVPN safe? goes through the six independent audits and the 2018 server breach. And if you are weighing it against the competition, NordVPN, ExpressVPN and IPVanish are compared side by side.
If you decide you do not need one, that is a legitimate conclusion from this page and we would rather you reach it here than after paying for two years.
It protects part of the problem. A VPN encrypts everything leaving your device, so whoever runs the network sees one connection to one address rather than the list of sites you visited, and it removes the risk of being steered to a fake page by a hostile network. It does nothing about accounts you are already signed into, and nothing about a convincing email.
Less than the marketing suggests. Nearly every site now uses HTTPS, so a stranger on the network cannot read your banking password out of the air the way they could ten years ago. What survives is the fake hotspot, the network operator seeing which sites you reach, and devices that reconnect automatically to any network name they have seen before.
Safer than without one, and not the same as safe. The tunnel protects the connection. It does not protect you from typing your details into a page that looks right, and it does not stop the services you are logged into from recording what you do.
Not by reading your traffic, because the connection to your bank is encrypted by the bank. The realistic route is a fake network that sends you to a page that looks like your bank, or an email that persuades you to enter the details yourself. A VPN closes the first route and not the second.
Ask staff for the exact network name rather than guessing from the list, treat any network that asks for more than a room number or a receipt code as suspicious, and turn off automatic joining so your phone does not reconnect to a name it saw once at another airport.