Know where encryption begins and ends
A correctly configured VPN encrypts traffic between your client and its gateway according to the tunnel policy. HTTPS continues to matter beyond that gateway. A VPN is one part of a connection, rather than a guarantee that every destination is trustworthy.
Check the basics first
Confirm the network name with the venue when needed. Avoid submitting credentials to unexpected pages. Complete the network’s captive portal before starting your VPN, then check a recent handshake and normal browsing.
Verify protection on your device
A running interface or a status screen cannot prove all traffic takes the intended path. Check the intended DNS, external address and IPv6 behavior. BiTTU does not currently claim a production kill switch or independent DNS leak validation.