VPN for Public Wi-Fi: What to Look For in 2026

Public Wi-Fi is the network you did not configure and will not see again. The hotel splash page, the cafe that still says FREE_WIFI, the airport SSID that shares a VLAN with everyone on the concourse. A consumer VPN is one control for that hop. It is not a cloak, and it is not a substitute for HTTPS.

HostSignal’s question is what to look for before you prepay two years — not which brand won a synthetic airport speed test. The placeholder shortlist is NordVPN, Surfshark, and ExpressVPN. Brand pairwise: NordVPN vs Surfshark and ExpressVPN vs NordVPN vs Surfshark. Employer-laptop policy: do you need a VPN for remote work and travel. Catalogs: best VPN for streaming and privacy 2026. Checkout wins.

What public Wi-Fi actually is

Treat the LAN as hostile until you have a reason not to. You do not control DHCP, DNS, or the captive portal. Other devices share a broadcast domain you did not segment. The operator can log destinations. Your laptop may still speak mDNS, SMB, or a development server you bound to 0.0.0.0.

HTTPS already encrypts the path from the browser to most banks, hosts, and Google Workspace. The VPN’s unique job on public Wi-Fi is the other traffic: DNS in sloppy setups, native apps that are not browser-HTTPS-only (desktop mail, chat, Git over SSH, database GUIs), and the silent drop back to the cafe LAN when the tunnel dies. Treat the VPN as a network hygiene layer, not a new identity.

You still typed the password on the site. A free Chrome “VPN” extension is not this product. If you cannot finish “On this SSID, I am worried that ____ will see ____,” do not buy a 27-month coupon. Phishing and reused passwords are a password manager, 2FA, and the host.

The checklist (this is the product)

You do not need a 14-feature bundle with identity monitoring you will not use. On public Wi-Fi you need controls you can name and test:

What to look for	Why it matters on a cafe LAN	What “good” looks like
Kill switch	The tunnel drops; traffic should pause, not silently use hotel DNS	OS-level / app kill switch on by default. Test: disable the VPN interface and load a what-is-my-ip page — it should fail or show the VPN IP, not the cafe
Modern protocol	Hotel uplinks are already the bottleneck	WireGuard, NordLynx, or Lightway as the thing the app actually uses
Leak story you can test	A “connected” app that still leaks IPv6 or ISP DNS is how the LAN still sees you	After connect: IPv4/IPv6/DNS/WebRTC leak test. Disable IPv6 on the NIC if the app cannot contain it
Audited no-logs + a jurisdiction you can explain	You are moving traffic through someone else	Named auditor and year. Panama vs Netherlands vs BVI is a legal process, not a personality
Apps on the OS you travel with	A VPN you cannot turn on in the boarding lounge will not be on	Official Windows / macOS / iOS / Android. Linux/CLI before a two-year prepay
Split tunnel	Bank apps, the captive portal, a local printer, or the employer VPN may need to stay off the consumer tunnel	Per-app or per-route settings exist on your platform
Captive-portal behavior	Hotel Wi-Fi often will not complete login while the kill switch is already on	A documented “allow portal” / pause flow that does not teach you to disable the kill switch forever
Refund window	One bad app week should not be a 27-month invoice	30 days on Nord, Surfshark, and ExpressVPN’s usual new-user story — confirm the SKU
Device math	Phones + laptop + tablet on one trip is already four connections	10-device caps (Nord Basic, Express Basic) vs Surfshark’s unlimited paid Starter
Renewal, not the tile	Same trick as cheap hosting. $2.49 is a prepaid coupon	Printed next bill if the vendor will print it. Calendar the reminder either way

Threat Protection is a nice LAN-adjacent filter. It is not a reason to buy a Prime/Pro bundle. Dedicated IPs are not required to start.

Apply the checklist to the three placeholders

HostSignal priced these as a new-customer purchase on 11 September 2026. ExpressVPN figures are from ExpressVPN’s order page. Surfshark figures are from Surfshark’s pricing page. NordVPN’s own pricing page did not reliably load here; Nord numbers are the US list Nord and 2026 reviews have been publishing for Basic.

	NordVPN Basic	Surfshark Starter	ExpressVPN Basic
Public-Wi-Fi job	Kill switch, NordLynx, longer public audit trail in most third-party writeups, Threat Protection on paid tiers (depth is SKU-dependent)	Kill switch, WireGuard, Bypasser split-tunnel, unlimited devices, 4,500+ servers / 100 countries on the official page	Kill switch, Lightway, “just works” app reputation, TrustedServer / RAM-oriented story, printed $99.95/year renewal
Long intro (typical)	About $3.09/mo on 2-year promos; upfront often ~$80–$85 when 3 extra months are bundled (27 months)	$2.49/mo, $67.23 for the first 27 months	$2.99/mo, $83.72 for the first 28 months
Month-to-month	About $12.99 — cheapest monthly of the three on the lists we use	About $15.45 on recent public tables — confirm	About $12.99 on recent public tables — confirm
What renews	Independent 2026 tables put ~~$139.08/year (~~$11.59/mo) on a 1-year cycle	Then annual “applicable renewal price” — Surfshark does not print the number beside the $2.49	ExpressVPN prints $99.95/year
Devices	10	Unlimited on paid Starter (trial caps exist)	10 on Basic (12 Advanced / 14 Pro)
Jurisdiction	Panama	Netherlands — Surfshark B.V. is on the pricing page	British Virgin Islands
Parent company	Nord Security	Nord Security	Not Nord Security (Kape ownership is a procurement fact)
Money-back	30 days on the usual offer	30 days, printed	30 days for new users

Read kill switch / protocol, then devices, then renewal, then parent company. Nord and Surfshark are sister products. Buying one of each is not diversification. ExpressVPN is the outside option. BVI is not magic — it is a different legal process. All three are fast enough for a call and SSH if the cafe uplink is. The uplink is usually the bottleneck. Split-tunnel Microsoft 365; keep the browser and SSH on the tunnel.

Configuration that is not optional

Buy the app. Then do this once on a network you trust, before the hotel:

Install the official client. Not a random APK. Not a “free VPN” clone of the brand name.
Turn the kill switch on. Leave it on. If the hotel portal cannot load, use the vendor’s portal-allow flow — then turn the tunnel back on before you type anything that matters.
Connect. Leak-test IPv4, IPv6, DNS, WebRTC. If IPv6 leaks, disable IPv6 on that NIC or pick a server/protocol the vendor documents as leak-safe.
Split-tunnel the exceptions: employer VPN / ZTNA, the bank app that fraud-flags datacenter IPs, the local printer. Do not split-tunnel Chrome “so it feels faster.”
Auto-connect on untrusted Wi-Fi if the app has that toggle. Name the home SSID as trusted. Do not add Hotel_Guest to that list.
OS updates current. A VPN will not patch last year’s browser.
Do not admin production hosting from a random USB charger. Mid-WordPress migration, a flaky hotel tunnel is a reason to wait. The beginner VPS you just bought can wait an hour.

A developer who binds a database to all interfaces on cafe Wi-Fi has a firewall problem. The VPN is a backstop, not a substitute for localhost.

What a public-Wi-Fi VPN will not do

It will not make you anonymous to the site you logged into, replace disk encryption at a border, satisfy an employer-tunnel policy, or fix a $3 shared host. Network privacy and cheap hosting TCO are different invoices. Catalogs belong in the streaming article. HTTPS plus a password manager is already a large upgrade. The VPN is the extra hop for leftover traffic. Worth a long promo if you sit on unknown SSIDs most weeks. Optional if you travel once on a carrier hotspot. Cellular is usually safer than hotel LAN — not automatically safe.

Who should buy which placeholder

Buy NordVPN Basic if you want the longer public audit trail, Panama positioning, and you can stay under 10 connections. Pay monthly (~$12.99) for two weeks of hotels. Pay the two-year promo only if you already like the app — and calendar a ~$139/year class renewal.

Buy Surfshark Starter for a household of devices and the official $67.23 / 27-month invoice. Accept a Netherlands legal home and an unpublished year-three rate. Skip One+ unless you independently want the identity extras.

Buy ExpressVPN Basic if you want a brand that is not Nord Security and a printed $99.95/year renewal. Pay the $83.72 / 28-month promo if you already like the app. Skip Advanced/Pro — those bundles are not public-Wi-Fi features.

Buy none if a free VPN already “works” (you are the inventory), if you think a VPN replaces HTTPS and a password manager, or if IT already issued the only tunnel you may run. Do not buy Nord and Surfshark together. Same group. Pick one app and the 30-day window.

A 30-day cafe test that is not theater

Name the device and the untrusted SSID class that must work (example: “Travel laptop, hotel captive portal, then SSH to staging”).
Install one brand. Kill switch on. Leak test. Live with auto-connect for a week of real cafes.
If the portal fight is the failure, learn the allow-flow once. If leaks persist after one documented fix, refund and try the next placeholder link.
Disable auto-renew until you are done deciding.
Decline antivirus, identity-theft, eSIM, and AI bundles at checkout unless those were the job.

Same discipline as cheap hosting: the tile is a term, the renewal is the product. The win on public Wi-Fi is the kill switch still on when you type a registrar password in a lobby — and knowing when HTTPS already did the job.

Affiliate destinations in this post’s frontmatter are PLACEHOLDER_AFFILIATE_NORDVPN, PLACEHOLDER_AFFILIATE_SURFSHARK, and PLACEHOLDER_AFFILIATE_EXPRESSVPN. We have not invented a commission or a private airport lab. Confirm live terms, device limits, and the refund window before you pay.