Blog

Is Hotel Wi-Fi Safe? The Real Risks and What to Do

A quiet hotel corridor at night with a row of identical doors, faint Wi-Fi waves drifting out from under each one and merging into a single stream, and an iPhone resting on a room key card in the foreground

Hotel Wi-Fi is shared with every guest, and a room-number login isn't encryption. Confirm the network name, use a VPN after signing in, bank on cellular.

Marco Lee7 min read

Hotel Wi-Fi is fine for reading the news, but I wouldn’t trust it with anything sensitive as it comes: you share it with every other guest, and the room number you typed to get on doesn’t encrypt anything. Ask the front desk for the exact network name, turn on a VPN as soon as you’re past the login page, and save banking for cellular data.

Why hotel Wi-Fi is riskier than your home network

The FBI’s 2020 warning about hotel Wi-Fi starts with who’s on it: “many unaffiliated guests, operating in a confined area, and all using the same wireless network.” Those guests “are largely unable to control, verify, or monitor network security” (FBI IC3).

The same notice lists what you can’t see from your room:

  • Hotel networks “are often built favoring guest convenience over robust security practices.” Smaller hotels often post the Wi-Fi password at the desk and rarely change it.
  • You can’t tell how old the equipment is, whether its firmware gets updated, or whether its default passwords were changed.
  • “Currently, there is no hotel industry standard for secure Wi-Fi access.”

None of that means someone is watching your hotel’s network. It means you can’t check. The general advice is in is public Wi-Fi safe, and airports have their own post, is airport Wi-Fi safe. This one covers what’s different at a hotel.

A room number and password isn’t encryption

Most hotel networks sit behind a sign-in page. Apple calls these captive networks and says the login screen may ask for a user name and password, an email address, or for you to accept terms and conditions (Apple Support).

That page decides who gets on. It does nothing for what you send afterwards. The FBI is blunt: a room number and password “only governs devices accessing the hotel’s network but does not provide a secure internet connection” (FBI IC3). It’s a check at the door, not a lock on your traffic.

If the Wi-Fi has no password at all, your iPhone labels it Unsecured Network in Settings > Wi-Fi. Apple says an open network lets anyone join and “monitor the websites you visit and other data transmitted over your network” (Apple Support).

What still protects you is the encryption your apps and websites add. The FTC says most websites now use encryption, so “connecting through a public Wi-Fi network is usually safe” (FTC, Feb 2023). That covers the contents, not everything. NIST notes that even with app encryption, someone on the network “would be aware of the domains, internet protocol (IP) addresses, and services” your device connects to (NIST NCCoE). And a padlock isn’t proof a site is real: scammers “create fake websites and encrypt them to make you think they’re safe when they’re not” (FTC).

Look-alike network names: ask the front desk

The hotel-specific trick is a network named almost like the hotel’s. The FBI calls it an “evil twin attack”: a criminal creates “their own malicious network with a similar name to the hotel’s network,” and guests join it by mistake. On a hotel network, criminals can also “redirect victims to false login pages” (FBI IC3).

The FBI’s advice: “Confirm with the hotel the name of their Wi-Fi network prior to connecting,” and don’t connect to any other network. I’d ask for the exact spelling at check-in, suffixes included, and if two names look like the hotel’s, ask again before joining either.

Watch what the login page asks for, too. A request for your email password is a reason to stop. A payment page isn’t automatically fake, since Apple notes that “fees and other charges might apply” on captive networks (Apple Support), but I’d check the price with the front desk before paying on a page that popped up by itself.

Don’t install anything a login page asks for

Apple’s list of what a login screen asks for doesn’t include a download (Apple Support). Hotels have a history here. In 2012 the FBI warned that travelers abroad, while setting up their hotel room’s internet connection, saw a pop-up offering an update to a widely used software product, and accepting it installed malware. Its advice: update before you travel, and while abroad, download updates only from the vendor’s website (FBI IC3). That warning was about laptops, but the rule carries over.

On iPhone, watch for a request to install a configuration profile. Profiles define settings for corporate or school networks and accounts, they can be downloaded from a webpage, and iOS asks your permission first (iPhone User Guide). A hotel login page has no reason to need one, so I’d decline. Installed profiles are listed in Settings > General > VPN & Device Management; what a VPN configuration on iPhone is explains what you’ll find there.

Is hotel Wi-Fi safe for banking?

The government sources lean different ways. The FTC says public Wi-Fi is usually safe because of encryption. The FBI’s hotel advice is stricter: “Avoid accessing sensitive websites, such as banking sites,” and if you must sign in to sensitive accounts, “use multi-factor authentication” and turn on login notifications (FBI IC3).

Here’s how I square them. HTTPS still protects what you send to the real bank. The hotel-specific risks are the fake network and the fake login page, and encryption doesn’t help if you type your password into the wrong place. So I bank on cellular data when there’s signal, and otherwise use the bank’s own app or a bookmarked address, with the VPN on.

Is hotel Wi-Fi safe for work?

The FBI’s 2020 notice was written for exactly this. It says accessing sensitive information from hotel Wi-Fi “poses an increased security risk over home Wi-Fi networks,” and that a device compromised there can let an attacker reach “the business network of the guest’s employer” (FBI IC3). Its advice: use a reputable VPN, follow your employer’s security policies for wireless networks, and “if available, use your phone’s wireless hotspot instead of hotel Wi-Fi.”

On iPhone, that’s Personal Hotspot (Apple Support):

  1. Open Settings and tap Personal Hotspot (or tap Cellular, then Personal Hotspot).
  2. Turn on Allow Others to Join.
  3. On your laptop, choose your iPhone from the Wi-Fi list and enter the password shown in Personal Hotspot settings.

It uses your cellular data, and Apple suggests turning Personal Hotspot off when you don’t need it, to avoid unnecessary data charges.

Is hotel Wi-Fi safe with a VPN?

Safer, yes. The FBI’s first recommendation for hotel Wi-Fi is a reputable VPN, to “encrypt network traffic, making it harder for a cybercriminal to eavesdrop on your online activity” (FBI IC3). A VPN encrypts communication “prior to leaving the device” (NIST NCCoE), so the hotel network sees a connection to the VPN server rather than the sites you visit.

What it can’t do: tell you which network is the hotel’s real one, or stop a fake login page from asking for your password. And you’re trusting the VPN company with your traffic instead of the hotel; is a VPN safe covers how to judge one.

The order that works on iPhone

  1. Join the name the front desk gave you in Settings > Wi-Fi.
  2. Sign in with the VPN off. A VPN can keep the login page from loading; Zapier lists “VPNs, DNS tweaks, or network problems” as causes (Zapier, updated Apr 2026). If the page still won’t show, see hotel Wi-Fi login page not showing.
  3. Turn the VPN on right after. Zapier says to turn it on “as soon as you’ve gotten past the login screen, at least.” The free VPN test shows whether your IP address changed and checks for WebRTC and IPv6 leaks.
  4. Leave Private Wi-Fi Address on. On a new network with weak or no security, your iPhone picks Rotating by default, a private address that changes every 2 weeks. Apple’s point: one address used everywhere lets network operators “more easily relate that address to the device’s network activity and location over time” (Apple Support).
  5. Set AirDrop to Contacts Only. The FBI says devices on hotel Wi-Fi shouldn’t be discoverable, and AirDrop is the closest iPhone setting. Open Control Center, touch and hold the top-left group of controls, tap AirDrop, then tap Contacts Only (iPhone User Guide).
  6. Turn off Auto-Join. The FBI advises against auto-reconnecting on a hotel network. In Settings > Wi-Fi, tap the More Info button next to the network and turn off Auto-Join, or tap Forget This Network when you check out (Apple Support).

What Mistero can and can’t do here

Mistero can’t tell you which network is the hotel’s real one, get you past a login page, or stop you from typing a password into a fake page. It doesn’t list the other devices on the hotel’s network either. For the fake-network risk, asking the front desk matters more than any app.

What it adds is the VPN step. Mistero VPN lets you “Connect with one tap on public Wi-Fi”, “Mask your IP address while the VPN is active” and “Turn on Kill Switch to help stop network traffic if the VPN disconnects”, and its security checks “Check Wi-Fi for visible connection or DNS anomalies” (App Store listing, read Nov 5, 2026). On hotel Wi-Fi I’d use it like any VPN: off for the login page, on right after. More on Mistero VPN.

Sources

Pricing New subscribers can start a 3-day free trial. After the trial, the subscription renews automatically at $12.99 per week unless you cancel at least 24 hours before the trial ends, in Settings > [your name] > Subscriptions (Apple Support). There's also a one-time Lifetime purchase for $99.99. These are US App Store prices as of October 2026; the purchase screen shows the current price before you confirm.

Frequently asked questions

Is hotel Wi-Fi safe with a VPN?

Safer, yes. The FBI's first tip for hotel Wi-Fi is a reputable VPN, which encrypts your traffic and makes eavesdropping harder. It can't tell you which network is the hotel's real one or stop a fake login page, so confirm the network name with the front desk first, and turn the VPN on once you're past the login page.

Is hotel Wi-Fi safe for banking?

HTTPS still encrypts what you send to your bank, and the FTC says public Wi-Fi is usually safe for that reason. The FBI's hotel advice is stricter: avoid banking sites on hotel Wi-Fi, and use multi-factor authentication if you must sign in. I'd use cellular data for banking whenever there's signal.

Is hotel Wi-Fi safe for work?

The FBI warned in 2020 that working from hotel Wi-Fi carries more risk than home Wi-Fi and can expose your employer's network. Its advice: use a reputable VPN, follow your employer's rules, and use your phone's hotspot instead of hotel Wi-Fi when you can.

Is hotel Wi-Fi safe for iPhone?

Not by default, but an iPhone makes the safe routine easy. Join only the network name the front desk gives you, sign in with your VPN off, then turn the VPN on. Leave Private Wi-Fi Address on, don't install anything a login page offers, and turn off Auto-Join for the network when you check out.
View All Blogs
VPN7 min read5 Nov, 2026Is Airport Wi-Fi Safe? What to Check Before You ConnectAirport Wi-Fi is fine for everyday browsing on the airport's real network. How to spot fake hotspots, what's known about juice jacking, and what to use instead.VPN7 min read5 Nov, 2026Is Public Wi-Fi Safe? Mostly, if You Check the NetworkPublic Wi-Fi is usually safe for everyday browsing, since most sites and apps encrypt your data. The real risks are fake networks and what the network can see.VPN6 min read2 Nov, 2026Weak Security Wi-Fi on iPhone: What It Means, How to Fix ItYour iPhone says Weak Security when a Wi-Fi network uses WEP, WPA or TKIP. Fix it on your router, or use cellular or a VPN on networks you don't control.