Yes you're good. The ads are basically lying, or at least vastly overblowing the importance of VPN. It's nice to have in some situations, but no, hackers won't immediately pwn you as soon as you connect to a McDonald's wifi.

Think of it like this

• HTTPS hides what you are saying.
• VPN hides who you are saying it to.

Non-Internet analogy:

You communicate via snail mail with someone. Both ends know the address of each other. So does the postal service delivering your mail. Everyone opening your letter can read (and with some work even manipulate) the content. That's HTTP.

Now you do the same, but write in code. Now the addresses are still known to every involved party but the content is secured from being read and thus from being manipulated, too. That's HTTPS.

And now you pay someone to pick up your mail, send it from their own address and also get the answers there that are then delivered back to you. The content is exactly as secure as before. But now you also hide your address from the postal service (that information has the guy you pay extra now though...) and from the one you are communicating with. That's a VPN.

So using a VPN doesn't actually make your communication more secure. It just hides who you are communicating with from your ISP (or the public network you are using). Question here is: do you have reasons to not trust someone with that information and do you trust a VPN provider more for some reason? And it hides your address from the guy you are communicating with (that's the actual benefit of a VPN for some, as this can circumvent network blocks or geo-blocking).

Long story short: Do you want to hide who you are communicating with from the network you are using to access the internet? Then get a VPN. The actual data you send (and receive) is sufficiently secured by HTTPS already.

Depends on the context. If you are at home on a wired / non public connection....HTTPS by itself is probably good enough for protecting your password / credentials from your general "web goblin" type of hacker.

However, if your device is compromised with malware (keylogger or whatever) then neither HTTPS nor a VPN can protect you.

HTTPS uses a special key sharing algorithm to safely encrypt your data so that it's relatively secure to transmit across the internet. Even if a man-in-the-middle intercepts it, they can't decrypt the data.

A VPN is an extra layer of security that hides your session from your internet service provider, or your boss, or random people on the WiFi at your local coffee place, that sort of thing. Using VPN is a good idea, but it's not a magic solution, and it's not always necessary. The VPN helps hide things like the websites you are visiting, your IP address, stuff like that. It also encrypts your traffic in a "tunnel" which is nice, but HTTPs packets are already encrypted. So HTTPS over a VPN is doubly encrypted.

Security-wise, you do no harm using both. However, using a VPN can be a little bit slower and some services (like the Google platform and major video content streamers) really don't like it when you use a VPN. You can sometimes get around this by purchasing a dedicated IP address from your VPN service provider, but that usually costs extra (on top of whatever you may be paying for the VPN service itself).

And...a dedicated IP may or may not fool those picky content streamers. They have gotten pretty aggressive about blocking VPNs because they know people use them to get around regional content lockouts and restrictions.

VPN is mainly good for bypassing region blocks (like Netflix) or as a tunnel through company firewalls. All other advertised use cases are either overstated or outright false.

You might not know if an app on your computer uses encryption when it communicates. And you dont know if a ssl cert has been exposed but not revoked yet. So no, you cant trust https alone.

And I've seen just how easy it is to setup a fake wifi and have peoples phones be autoconnected to it because the victims have an old public network in the "remembered networks" list. On a dev conference.

So i use either use vpn or a private mobile network. Well, honestly I actually don't. I suck at practicing what I preach. Convenience versus risk.

your https connection is sufficient to protect the connection.

only unencrypted traffic is at risk to public wifi attacks.

If all you use is a web browser and all the sites you visit are HTTPS only

There's a possibility, but not a big one that any given WiFi has an decrypting proxy in place. Your device should be giving a big warning flag if a certificate was found issued by an untrusted cerificate authority. It's possible if someone like Google or a government body ran the portal that they could issue 'trusted' certificates for sites on the fly through such a proxy and grab whatever they want while it's decrypted mid stream.

The whole premise of HTTPS as security is based on the notion that the CAs at the end of the chain are trustworthy and wouldn't do something like that, but it is possible.