Public WiFi Security in Asia: A Practical Routine for Travellers

Every guide to public WiFi security opens with a hacker in a hoodie. The real risks are duller, which is why they work.

Fake hotspots. Someone sets up a network with a name that looks like the café's or the airport's. Your phone connects, and everything you do passes through their device. Names like "Airport_Free_WiFi" are easy to copy.

Unencrypted traffic. Most websites and apps use HTTPS today, which protects the content of your traffic even on an open network. But not every app does, and some captive-portal login pages are plain HTTP. What you send over those can be read by someone on the same network.

Tampering. Some hotel and airport networks inject their own ads or tracking into pages. That is not necessarily criminal, but it is surveillance of a kind.

Shared devices and smart gadgets. In hostels, coworking spaces and Airbnbs, other people's phones and laptops sit on the same network, and some older devices are poorly secured.

Phishing, which no VPN fixes. A message that looks like it comes from your bank or from the hotel and asks for a login is the most common real attack. It works on any network.

A VPN encrypts the connection between your device and the provider's server. On a shared network that means others on the WiFi cannot easily read or alter the traffic that goes through the tunnel, and a fake hotspot sees only encrypted data. That covers the first three risks above reasonably well.

It does not help with phishing, with malware you install yourself, or with accounts that have weak or reused passwords. It does not make you anonymous, because the sites you log into know who you are, and the VPN provider can see where the traffic goes. And it can slow your connection on an already slow line. Treat it as a good habit, not as armour.

Two small habits help in practice. First, disable automatic WiFi joining, so that your phone doesn't connect to every network it remembers from a previous trip. Second, forget the network when you leave the hotel. Both take a few seconds and prevent a surprising number of accidental connections.

Hotels. Room networks often share one password between guests, which means other guests are on your network. Use the VPN, and avoid putting the laptop's file sharing on. If your room has a wired connection, it tends to be less crowded than the lobby WiFi.

Airports and stations. Large, anonymous, busy, and convenient. Fine for reading and streaming, less good for banking. Use your own data for anything sensitive. Charging stations are another risk: use your own plug adapter or a charge-only cable where you can.

Cafes and night markets. A café's WiFi is often a consumer router with an old password. Keep the visit short, use the hotspot for important logins.

Coworking spaces and homestays. Better equipped, but busier. Remote workers should use their company VPN for work systems and a personal VPN for the rest. In places like Bali, Da Nang or Chiang Mai, where long stays are common, a decent VPN and a local SIM are a better investment than constant worry.

Most WiFi trouble on trips comes from habits, not from exotic attacks.

Reusing one password everywhere. If a single leaked password opens your email, your bank and your cloud storage, no VPN will save you. Use a password manager and unique passwords, at least for email and money.

Skipping updates until you get home. Phones and laptops patch known holes. Update before the trip, not in the departure lounge.

Accepting every prompt. Fake login pages, "install this certificate" and "download our WiFi app" are classic signs of something wrong. A hotel network that asks for your room number is normal. One that asks for your card details is not.

Trusting the lock icon blindly. HTTPS protects the connection, not the honesty of the site. A phishing page can have a padlock.

Leaving file sharing and AirDrop open. Set them to contacts only, or off, on a shared network.

Relying on SMS codes abroad. If your SIM is off or roaming is disabled, you can't receive them. Move to an authenticator app before you travel.

Fix those, and a VPN becomes the sensible final layer instead of the only one.

For WiFi safety you do not need a special China-grade setup. You need a mainstream app that is easy to use, connects automatically on untrusted networks, runs on all your devices, and doesn't slow you to a crawl. Add a refund window so that you can test it, and a privacy policy you have read.

We link to NordVPN as one option: simple apps and, according to the company, support for up to ten devices at once. Our review lays out the downsides, and the checklist shows how to set it up before you fly. For China specifically, read the China guide before anything else.

This page is an affiliate page in part: if you sign up through our NordVPN link we may earn a commission at no extra cost to you. If your trip is short and you stay on mobile data, you may not need a VPN at all, and we'd rather you know that.