My laptop locks onto a network called "CoffeeShop_Guest" before I've even paid for the coffee, and a packet capture is already running in a second window. Two years of VPN testing will do that to a person. You stop trusting an open network the moment you join it. I'm at a window table in a Capitol Hill coffee shop, running the same public wifi security check I run everywhere: what does my traffic look like with the VPN off, and what changes once it's on. Call it cyber hygiene, not paranoia.
Quick disclosure up front: a few of the VPN names below carry affiliate links, and I earn a commission if you subscribe through one — at no extra cost to you. I've paid for and tested every account myself, and my partner has opinions about how much of our internet bill goes toward "research."
Encryption Basics: What an Open Network Actually Leaks
Most of what leaks on an open network isn't the content of your messages. The HTTPS padlock handles that part reasonably well, encrypting the page you're loading and the form you're filling out. What it doesn't cover is the metadata around it — which sites you're visiting, when, and for how long. On a coffee shop's own network monitor, or in a packet sniffer running two tables over, that metadata sits in plain text long before anything reaches an encrypted page.
None of this was on my radar before 2023, when my employer disclosed a third-party data breach and my own information ended up in a leak dump. That email changed how I treat every network I don't control, including my own. At home I run a VPN router setup so protection isn't something I have to remember to switch on for every device; a public network doesn't offer that convenience, so a VPN client has to work harder to cover the gap.
NordVPN's Coffee Shop Run
To see the difference directly, I ran a controlled comparison at the same table: several minutes on the open network with the VPN off, then the same stretch with NordVPN switched on. NordVPN's NordLynx protocol (their proprietary spin on WireGuard, not marketing fairy dust) is the one I reach for on public networks specifically because of how little overhead it adds — that's a protocol choice more than a brand-loyalty one, and I've gone deeper into how it stacks up against other protocols in a separate speed test.
The core of that protection is AES-256, wrapping everything in a tunnel before it ever reaches the coffee shop's router. With the VPN off, my DNS queries went out as plain text — anyone running a basic sniffer nearby could see which domains I was resolving, GitHub included. Captive portals are notorious for hijacking that exact DNS traffic, which is why checking the resolver is the first thing worth doing after joining any network you don't control.
Once NordVPN was active, all of that metadata disappeared into a single encrypted stream. The network owner could still see I was connected to something, but not what, and definitely not where. That's the whole point — not invisibility, just noise where there used to be a clear signal.
NordVPN also carries an independently audited no-logs policy, which matters more than the marketing badge suggests — it's the difference between a company promising not to keep records and a third party actually checking. If you work the way I do, laptop open in a different room or building most days of the week, I've gone deeper into that specific case in my best VPN for remote software developers piece.
Is HTTPS Already Enough?
A coworker's counterargument is that HTTPS makes a VPN redundant, since nearly every site uses it now. That argument misses what HTTPS was actually built to protect. It secures the content of a page, not the fact that you're loading it — and it does nothing to stop an "Evil Twin," a rogue access point broadcasting the same name as the real one. Join the wrong "CoffeeShop_Guest" (there's often more than one) and an attacker can watch every site you visit, or try to downgrade your connection to plain HTTP.
This is where the case for a more configurable VPN gets stronger. Private Internet Access ships with open-source apps you can actually audit, plus encryption settings you can tune yourself instead of trusting a single default — useful if you want to verify what's happening under the hood rather than take a company's word for it. Its server network is the largest of any major provider, over 35,000 servers, which usually means a low-latency hop is close by even from a random coffee shop. It's overkill for someone who just wants a connect-and-forget button, and PIA's defaults ask more of a first-time user than NordVPN does — that trade-off is the whole comparison in miniature.
A Casual Coffee Run vs. a Reader's Fintech Threat Model
For a casual coffee-shop session, the realistic adversary is opportunistic and local — someone on the same network with a free sniffing tool, not a nation-state — so the defense that actually matters there is narrower than blanket anonymity. My neighbor, who spends most weekends building custom mechanical keyboards and swapping switches every few months, has never opened a VPN app in his life, and for what he does on public wifi, he probably doesn't need one. A reader named Darby Kuang writes in with a very different starting point: they work remotely for a fintech company and think through their own threat model with more precision than most security teams I've worked alongside.
That's also where the difference between a browser extension and a full system tunnel actually matters. A browser-only VPN protects what's happening inside Chrome or Firefox, which is fine for casual browsing, but it leaves every other app — an email client, a Slack desktop app, whatever syncs quietly in the background — sending traffic in the clear. Darby runs the full client on every device for exactly that reason, and I'd do the same in their position.
Kill Switches, Camouflage Mode, and the Value Picks
Whether a VPN is worth trusting comes down to what happens when it drops, which is the entire argument for a kill switch — the setting that cuts your internet the instant the tunnel disconnects, so a dead VPN can't quietly fall back to your raw connection without you noticing. I tested that behavior with CyberGhost VPN, which pairs it with servers labeled by use case and backs the subscription with a 45-day money-back guarantee, longer than the standard month most providers give you. CyberGhost also runs over 11,000 servers across 100 countries — a smaller net than PIA's, but plenty for a coffee-shop scenario.
Surfshark solves a different problem. Its Camouflage Mode disguises VPN traffic so it looks like ordinary HTTPS, which is genuinely useful on networks that flag or throttle anything resembling a VPN tunnel — some hotel and airport networks do this more aggressively than any coffee shop I've tested at. Surfshark also allows unlimited devices on one account, which matters if you're covering a whole household instead of just a laptop, and its no-logs policy comes out of a Netherlands-based headquarters rather than a jurisdiction with murkier data-retention rules.
What Actually Failed in My Testing
Not everything I've tried earned a permanent spot on my devices. A bundled VPN that came free with an antivirus suite is the clearest example — it sounded like a reasonable shortcut, one less subscription to manage, until I ran a speed test on my gigabit home connection and watched throughput drop by roughly 80 percent. That's not a rounding error. That's the difference between a usable connection and a stalled one, and it's why I stopped trusting "included free" as a feature.
The moment that actually convinced me came earlier, running Wireshark against my own machine mid-tunnel: every packet leaving my laptop carried the VPN's exit address, and not one of them carried anything that traced back to my actual connection at home. That's the test I trust over any marketing page — not a claim, just a capture with nothing incriminating in it.
Choosing Between Them
If you want the simplest possible answer, choose NordVPN — fast enough that you won't notice the tunnel, backed by an audited no-logs policy, built for someone who wants to turn it on and stop thinking about it. Choose Private Internet Access instead if you want to see and adjust the encryption settings yourself, or if a 35,000-server network matters more to you than a polished app. Choose CyberGhost when the money-back window and specialized servers outweigh sharing a parent company with a couple of competitors. And choose Surfshark specifically when a network is hostile to VPN traffic in general, or when one subscription needs to cover every device in the house instead of just yours.
This won't make you invisible, and no VPN stops you from opening a malicious attachment or typing a password into a convincing fake login page. What it does is turn a wide-open broadcast into a private conversation, which on a network you don't control is most of the battle. If you haven't set anything up yet, NordVPN is the one I'd point a first-timer toward — it's the closest thing I've found to a configure-once-and-forget setup.