Who this guide is for
You use café, airport, hotel or station Wi-Fi and want to know what the network can still see, and what a VPN adds on top of HTTPS.
Who it’s not for
A VPN won’t stop phishing, protect your accounts or fix a device that already has malware on it. Strong, unique passwords and two-factor authentication do that job.
In short
- HTTPS already encrypts what you send to most websites. The network can still see which sites and services you use, and when.
- A VPN puts the traffic from your device into one encrypted tunnel, so the hotspot sees a single connection to a VPN server.
- Lookalike hotspots, DNS lookups, dropped connections and apps that don’t encrypt properly are the gaps a VPN helps close.
- A VPN protects the connection, not your accounts. It won’t stop a phishing page, so keep two-factor authentication on.
On this page
Free Wi-Fi turns up wherever you need it: the station, the café, the hotel lobby, the hospital waiting room. Joining takes one tap, and that is the problem in miniature. You don’t know who set the network up, what equipment it runs on, what it records or who else is connected. Most of the time nothing goes wrong. This guide explains what is genuinely at risk on a network you don’t control, what the padlock in your browser already handles, and where a VPN earns its place.
What a hotspot can still see
Public Wi-Fi is less risky than it used to be, because most websites and apps now encrypt their traffic with HTTPS. On an up-to-date phone or laptop, the password you type into your email or bank is encrypted before it crosses the hotspot, so anyone claiming that public Wi-Fi hands your passwords to the person at the next table is exaggerating.
Encryption at the website level still leaves a fair amount in view:
- Where you go. The names of the sites and services your device connects to are usually visible to the network, through DNS lookups and the way encrypted connections are set up. So are the timing and rough size of each request.
- Anything that isn’t encrypted. Older apps, some background traffic and the odd site that still loads over plain HTTP can travel readable.
- Your device. On a shared network your laptop or phone sits alongside everyone else’s, and devices that advertise themselves for file sharing or casting can be visible to others.
- Your activity over time. The operator can link everything your device does for as long as it stays connected, and every site you visit sees the hotspot’s IP address.
The risks worth knowing about
Lookalike hotspots
Anyone can create a network called "Airport Free WiFi" or name one after the café next door. If your device joins it, the person running it sits in the middle of your connection. They can see which services you contact, interfere with anything that isn’t encrypted and put up convincing sign-in pages. HTTPS still protects properly encrypted sites, but a rogue hotspot has other ways to cause trouble.
Networks that log and profile
A genuine hotspot isn’t necessarily a private one. Many public networks are run by third-party providers that record the domains devices visit, for security, for marketing or simply by default. The terms you accepted on the sign-in page may well have allowed exactly that.
Sign-in pages
Sign-in pages, often called captive portals, work by intercepting your first connection. That is normal, but it means the network is built to step into your traffic, and a badly made or malicious portal can ask for more than it needs. Treat any portal that wants you to install software as a warning sign.
Dropped connections
Public Wi-Fi drops, reconnects and hands you between access points. Each wobble is a moment when apps retry and, with nothing to stop them, send traffic over whatever connection is available.
Every feature on every plan
Encrypt your connection on up to 5 devices at once
- Apps for Windows, macOS, iOS, Android and Fire TV
- Kill switch (Windows app)
- Split tunnelling (not on iPhone, iPad or Mac)
- DNS and IPv6 leak protection
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
How a VPN helps on public Wi-Fi
When you connect with DarkMatter, the app builds an encrypted tunnel from your device to a VPN server, and your traffic crosses the hotspot inside it. To the network, your device is talking to one server, and nothing inside that conversation is readable.
- AES-256 encryption covers the traffic in the tunnel, including traffic from apps that don’t encrypt properly on their own.
- DNS leak protection is designed to send your lookups through the tunnel, so the hotspot doesn’t collect a list of the sites you visit.
- IPv6 leak protection is designed to stop traffic slipping around the tunnel on networks that hand out IPv6 addresses.
- A kill switch in our Windows app is designed to block traffic if the tunnel drops, which is exactly what unreliable Wi-Fi tends to cause.
- A choice of protocols. WireGuard is the default, with OpenVPN, IKEv2 and IPSec available. If you can’t connect on a particular network, try a different protocol.
- Up to 5 devices on one plan, so your phone, laptop and tablet can all be covered.
| On a public hotspot | Without a VPN | With DarkMatter |
|---|---|---|
| Contents of HTTPS sites | Encrypted by the site | Encrypted by the site, inside the tunnel |
| Which sites and services you use | Visible to the network | Hidden inside the tunnel |
| DNS lookups | Usually answered by the hotspot | Designed to go through the tunnel |
| Apps that don’t encrypt properly | Readable in transit | Encrypted inside the tunnel |
| IP address websites see | The hotspot’s address | The VPN server’s address |
| If the connection drops | Traffic carries on unprotected | Kill switch (Windows app) designed to block traffic |
| Sites you sign in to | Know it’s you | Still know it’s you |
A routine for any hotspot
- Check the network name with staff before you join, especially in airports, hotels and conference venues.
- Complete the sign-in page first, then connect DarkMatter. The portal needs to see your connection before it lets you on.
- Connect before you open anything else, and stay connected for the whole session rather than switching on only for something sensitive.
- Treat the network as public. If your laptop asks what kind of network it is, choose public, and turn off file sharing.
- Forget hotspots you won’t use again, so your device doesn’t rejoin a lookalike later without asking.
- Keep two-factor authentication on for email, banking and anything else that matters, so a stolen password alone isn’t enough.
The honest bit
An honest note on what a VPN can’t do on public Wi-Fi
A VPN protects the path between your device and our server. It doesn’t make every risk on public Wi-Fi go away, and it isn’t a substitute for the rest of your security.
- It won’t stop phishing. If a convincing page asks for your password, the tunnel will carry it there faithfully. Check the address before you type.
- It doesn’t protect your accounts. Sites you sign in to still know it’s you. Strong, unique passwords and two-factor authentication do that job.
- It can’t fix a compromised device. Malware already on your laptop or phone works just as well with a VPN connected.
- It may not connect. Some networks block VPN connections, and we can’t promise DarkMatter will connect on a particular hotspot.
- It adds a step. Your traffic goes to our server before it reaches the site, which adds some overhead rather than making anything faster.