Answers › Technology

Is hotel WiFi safe to use?

Answered by Shared Security Podcast with Tom Eston, Scott Wright, Kevin Tackett · Sep 17, 2026

Hotel WiFi is not automatically unsafe, but it's never a network you should blindly trust. That's the verdict from Tom Eston and Scott Wright on episode 577 of the Shared Security Podcast, recorded after Microsoft published research on a campaign called CaptiveCrunch that used fake hotel login pages to steal passwords and push malware. The practical answer: use it for low-stakes browsing if the login process looks normal, disconnect the moment anything looks off, and use your phone's hotspot for anything that matters.

The login page is where attacks happen

Almost every hotel network starts with a captive portal, the page that pops up asking for your room number and last name or an email address. Tom explains that this page is the weak point, because you're already expecting to type something into it. Microsoft's CaptiveCrunch reporting described attackers manipulating those portals so that instead of a normal hotel form, guests saw prompts for their Microsoft account, a device code login, or a download claiming to be a required security scan.

The hosts' advice is to treat the captive portal as the moment to slow down rather than the moment to click through. A real hotel portal asks for room details or an email and nothing else. It does not ask for your Microsoft, Google or Apple password. It does not ask you to enter a code on another device. It does not ask you to install anything.

"the moment your phone or laptop throws up a hotel login page is exactly when you should slow down and pay attention"

What the lock icon does and doesn't prove

A lot of people have been taught that HTTPS and the padlock mean a page is safe. Tom pushes back on that. The padlock means your connection to that page is encrypted. It says nothing about who owns the page. Attackers get valid certificates for their fake portals all the time, so a phishing page can show a perfectly normal lock.

What HTTPS does protect is the content of your traffic to legitimate sites. If you're on your bank's real website over HTTPS, someone on the same hotel network can't read what you're sending. The risk on a hostile network isn't usually eavesdropping on encrypted traffic. It's being tricked into handing over credentials on a page that looks right.

So the check isn't "is there a lock." It's "is this the page I expect, asking for the thing a hotel would reasonably ask for."

"that doesn't mean you're on the legitimate page. It only means that you've got SSL or TLS turned on"

A VPN helps, but not with the thing people assume

Scott addresses the other common belief, that a VPN makes any network safe. A VPN encrypts your traffic between your device and the VPN provider, which hides what you're doing from the hotel network and anyone sniffing it. That's genuinely useful, especially on a network you don't control.

But the hosts point out what it doesn't do. A VPN can't connect until you've gotten through the captive portal, so it offers no protection during the exact step where CaptiveCrunch attacks happen. And if you're tricked into downloading a fake security tool, a VPN does nothing to stop that malware from running. Scott's summary is that a VPN is for hiding web traffic, not for stopping a malware-style attack.

Use one on hotel WiFi, by all means. Just don't let it make you careless at the login screen.

Red flags that mean disconnect now

The episode gives a short list of signs that a hotel network isn't what it claims to be, and the advice for each is the same: disconnect and use something else.

Multiple similar network names is the first. Scott describes walking into a hotel and seeing four or five networks, one of which is a lookalike like "Hilton Free WiFi." Ask the front desk for the exact network name and ignore the rest.

Second, any prompt that doesn't fit. If you connect and instead of a hotel login you get a Microsoft sign-in, an antivirus warning, a request to install a certificate or a download, that's not normal. Tom's rule is simple: if you're not seeing a hotel login page, that's your first warning sign.

Third, certificate warnings and unexpected popups once you're connected. And fourth, Scott adds, weird email after you've entered your address into a portal. That's a hint the portal was harvesting.

For anything sensitive, both hosts default to the same alternative. Tom says he uses his phone's built-in personal hotspot, and the speed and quality are often better than the hotel's network anyway. Cellular data isn't perfect, but it takes the hotel, and whoever is lurking on its network, out of the picture entirely. As Tom puts it, the right answer depends on your threat model, on who you are and what you're doing online. For most travelers, though, a hotspot for email and banking and hotel WiFi for streaming is a sensible split.

"you're not seeing a hotel login page. That should be your first warning sign that something else is going on"

People also ask

Should I use a VPN on hotel WiFi?

Yes, it's a good idea for hiding your traffic from the network. Just remember it can't connect until after the captive portal, so it won't protect you from a fake login page.

Is it safe to log into my bank on hotel WiFi?

The hosts recommend using your phone's cellular hotspot for banking and email instead. If you must use hotel WiFi, make sure you got through a normal portal, type the bank's address yourself, and never follow links from popups.

What should I do if I already entered my password on a suspicious hotel login page?

Change that password immediately from a trusted connection, turn on two-factor authentication if you haven't, and check the account's recent sign-in activity for anything you don't recognize.

Based on Shared Security Podcast episode 577, "Is Hotel WiFi Safe?", released September 7, 2026. Credit to hosts Tom Eston and Scott Wright and the Shared Security Podcast.