Hotel Wi-Fi is often unsecured because hotels prioritize easy access for hundreds of rotating guests over encryption. An open network with a sign-in page means nobody needs a password at check-in, the front desk fields fewer complaints, and old devices connect without trouble.
Here's what's usually going on behind the scenes:
- Captive portals instead of passwords. The page asking for your room number and last name controls who gets internet access. It does nothing to encrypt the connection, so data travels over the air unprotected.
- One password for everyone. When a hotel does add a password, it's typically a single shared WPA2 key printed on a card. As a 2026 hospitality Wi-Fi guide from Purple explains, any guest who knows that key can potentially decrypt other guests' traffic.
- No client isolation. Some networks let guest devices see and reach each other, which opens the door to snooping and spoofing attacks.
- Old hardware. Smaller properties may run aging routers that only support outdated security and never get firmware updates.
The FTC has long warned that a network asking for no password, or just a shared one for access, should be treated as unsecured. A fix exists: the Wi-Fi Alliance's Enhanced Open standard encrypts open networks without a password, but hotel adoption is slow.
None of this means your bank password is floating around in plain text. Most sites and apps use HTTPS, which encrypts the content. What weak hotel Wi-Fi exposes is metadata like the sites you visit, plus your device to fake networks and nearby attackers. A VPN such as NordVPN adds the encryption the hotel left out.