How to use hotel Wi-Fi safely

Hotel Wi-Fi is a shared network with a sign-in page in front of it. That is the whole picture. Hundreds of guests, a login that asks for your room number and last name, and a provider you did not choose. Most of what you do on it is encrypted and fine. The rest of this guide is about the parts that are not. For the general case, read Is free public Wi-Fi safe?

How hotel networks differ from a coffee shop

The login is tied to you. Marriott’s support page says to pick the MarriottBonvoy or MarriottBonvoy_Guest network, or a [Brand]_Guest name, and that a login screen will usually appear where you enter your room number and last name. If it does not appear on a Windows PC, you type marriottwifi.com into a browser (Marriott). That means the hotel can tie your device to your reservation. That is normal and it is how they bill premium tiers.

The provider varies. The same Marriott page says internet providers vary by hotel and region (Marriott). The network you are on is usually run by a contractor, not the front desk.

It is a captive portal. Apple describes these as networks where you wait for a login screen and may be asked for a username and password, an email address, or to accept terms (Apple). Hyatt’s own announcement says sign-on steps vary by property (Hyatt).

“Free” has conditions. Hilton says members get free Wi-Fi throughout the hotel during their stays (Hilton), but the fine print adds that Wi-Fi may not be complimentary in meeting spaces or at properties with a resort fee, and that the benefit requires booking through a Hilton channel (Hilton). Hyatt’s free Wi-Fi covers guest rooms and lobbies but not meeting rooms (Hyatt). Marriott offers a paid upgrade at internetupgrade.marriott.com and free enhanced Wi-Fi for Gold Elite and above (Marriott).

Networks are split. A Courtyard property guide notes that its meeting network is isolated from the public and guest room networks (Marriott). Guest rooms get their own slice. What you cannot assume is that guests are isolated from each other inside that slice.

The real risks

A fake network in the lobby

CISA’s description of an evil twin: an attacker copies a legitimate access point and broadcasts a stronger signal so your device joins the copy (CISA). A hotel lobby is a good place for this because everyone is looking for the same name. Marriott’s own advice is to disconnect and contact the front desk if you see a suspicious network name or an unexpected prompt (Marriott). See How to tell if a Wi-Fi hotspot is fake for the tells.

Other guests on the same network

NIST’s travel tip describes an adversary on the same public network capturing unencrypted traffic and seeing every site you go to. It adds that even when an app encrypts its data, an attacker on the network can see the domains, IP addresses, and ports your device uses (NIST NCCoE). In a hotel, that attacker could be three doors down for a week.

The hotel’s own view

Marriott says it plainly: wireless networks are not inherently secure, and communications over guest Wi-Fi may be intercepted by unauthorized third parties (Marriott). The network operator is not a third party. It sees everything the eavesdropper above sees, by design, and it has your name and room number next to it.

The sign-in page itself

Marriott publishes what its portal will and will not ask for. It will only ask for hotel-related details such as room number or last name. It will never ask for third-party credentials, device codes, software downloads, or credit card or banking information. If you are prompted for any of those, stop and call the front desk (Marriott). That is a good rule for every hotel, not just Marriott.

What HTTPS protects and what a VPN adds

The FTC’s bottom line is that because most websites now encrypt, public Wi-Fi is usually safe, and you should look for the lock or “https” before you type anything sensitive (FTC). Marriott says the same about its own sign-in page: verify it uses https before entering anything (Marriott).

A VPN is the right tool for a week-long stay where you would rather the hotel’s contractor not have a log of every domain you visited. Marriott itself says a VPN can protect you on any shared Wi-Fi network including its own, and that it does not endorse a specific product (Marriott). Before you install one, the FTC says to confirm the app encrypts your information, review its permissions, and check whether it shares your data with third parties (FTC). Our picks are at Best VPN for public Wi-Fi. Proton VPN is the vendor cited above.

Sign in to the hotel portal first, then turn the VPN on. GL.iNet’s router documentation lists disabling VPN connections as a troubleshooting step when a captive portal will not load (GL.iNet). The same logic applies to a phone.

For banking specifically, CISA says to turn off Wi-Fi and use cellular data instead (CISA). More in Is online banking safe on public Wi-Fi?

Streaming and casting in your room

Streaming sticks do not handle sign-in pages the way phones do.

• Chromecast and Google TV Streamer do not support networks that require a captive portal, which Google says is typical of hotels, schools, and dorms. Google also warns that on guest, hotel, or public networks with client isolation turned on, you cannot set the device up at all (Google). That same isolation is what stops your phone from seeing your stick.
• Roku has a Hotel & Dorm Connect mode on supported models. Settings, Network, Set up new wireless connection, pick the hotel network, then choose “I am at a hotel or college dorm” and finish the sign-in on your phone or laptop. Roku’s US help page for this is no longer available, so these steps come from Roku’s Canadian help page. A Roku blog post for US, Canadian and UK users describes the same feature.
• Apple TV detects a captive network and offers “Continue on iPhone or iPad,” where you complete the login. Apple notes some captive networks have time limits and you will need to repeat the steps when the session expires (Apple).

If you sign in to a streaming app on the room’s own TV, sign out before checkout. The next guest gets that TV.

Travel routers

A travel router joins the hotel network once and shares it with your devices. GL.iNet’s documentation says the hotel network will only recognize the router as a single device, which matters at hotels that cap you at two devices, and that it can clone your phone’s MAC address if the hotel tracks devices that way (GL.iNet). You can also run the VPN on the router so every device behind it is encrypted automatically (GL.iNet).

Two cautions from the same docs. The router’s “login mode” for captive portals switches DNS to automatic and may leak your network activity to the hotspot provider until you turn it back (GL.iNet). And a router does not make the hotel network trustworthy. It gives your devices a private network behind one connection, with the VPN doing the actual hiding.

Your phone already does a smaller version of this. iPhones use a different Wi-Fi address on each network so a fixed hardware address cannot track you across stays (Apple). Android 10 and later randomize by default (Android Open Source Project). Leave both on. If you need to give a travel router’s details to a guest, the Wi-Fi QR generator saves typing.

Check-in checklist

1. Ask the front desk for the exact network name. Write it on the key card sleeve.
2. Join only that name. Skip anything close but different.
3. On the sign-in page, give only what the hotel asks for: room number and last name. Never a password, card number, or app download.
4. Confirm the sign-in page shows https before you type.
5. Once you are through, turn on your VPN. Keep it on for the stay.
6. Bank, pay, and change passwords on mobile data. Need a cheaper line for that? See free and cheap mobile plans or free government phones.
7. Set AirDrop or Quick Share to contacts only, and turn Bluetooth off when you are not using it (CISA).
8. If you brought a Roku or Apple TV, use its hotel mode. Leave the Chromecast at home.
9. Sign out of anything you logged into on the room TV.
10. At checkout, forget the network on your phone so it does not rejoin on your next visit.