What the tunnel changes, and what it leaves
- Someone on the same Wi-Fi sees a connection to the VPN server. They do not see the sites inside a working tunnel.
- The site you open sees the VPN exit address, not the café’s address.
- HTTPS still matters. It is the lock between you and that site. The VPN is the lock across the shared network.
- A phishing page, a hostile download, and a compromised laptop are outside the tunnel’s job.
- A provider that keeps logs can still see destinations the café can no longer see. That is a privacy-score question, not a Wi-Fi test.
Security scores are not café grades
These six rows are context for the two threats above. The full security table is on the kill-switch page. None of these numbers is a public-Wi-Fi pass.
| Provider | Security | Privacy | Audit type |
|---|---|---|---|
| Mullvad | 94 | 95 | independent |
| NordVPN | 92 | 94 | independent |
| Private Internet Access | 91 | 82 | independent |
| Proton VPN | 91 | 98 | independent |
| ExpressVPN | 90 | 96 | independent |
| Windscribe | 83 | 85 | independent |
| Question | Where scoring puts it | What the file stores |
|---|---|---|
| Can the café read the tunnel? | Security features, not a location test | No public-Wi-Fi field |
| If the tunnel drops, does traffic leak? | Security, 15% | One security number. No kill-switch pass or fail |
| Can the VPN company see destinations? | Privacy, 25% | audit_type, jurisdiction, privacy score |
| Is the page you opened a fake login? | Outside the eight weights | Not in the file |
Remote-work sessions on coworking Wi-Fi are the same local-network problem, plus whatever the employer installed on a company laptop. A personal VPN does not remove device-management software.
Related on this site
- Best VPN for travel — parent use-case for airport, hotel, and café Wi-Fi.
- VPN for remote work — coworking and hotel sessions.
- Kill switch failure and no-logs claims.
- How to read a no-logs audit — what the provider may store after the café is blind.
- Methodology and comparison JSON.
- Match engine.
FAQ
Does a VPN make public Wi-Fi safe?
No. It encrypts the path from your device to the VPN server. Phishing, malware, and a provider that logs are separate problems. The comparison file has no public-Wi-Fi test result.
Do you still need HTTPS if the VPN is on?
Yes. HTTPS protects the conversation with the site. The VPN protects the hop across the shared network and hides destinations from that network. They are different locks.
Which score says a VPN was tested in a café?
None. Each provider has one security score. Methodology includes encryption and leak controls in that 15 percent category. vpn-comparison-2026.json has no café or hotel field.