If you are not using a VPN, then every site you visit that sends or receives anything sensitive (especially passwords) should be HTTPS rather than just HTTP. The 's' in HTTPS stands for secure which is provided by TLS handshaking and encryption. In effect, when using TLS (i.e. HTTPS, which I refer to interchangeably here) you are effectively using a separate VPN for each site.
It might be worth adding a comment about why this is good practice. There are several concerns when using any public hotspot. The first is that some other Wi-Fi user has configured their device (laptop, phone, ...) to receive all the traffic being broadcasted from the nearby systems. This can also be prevented if the hotspot is properly configured to use encryption, but that is not wholly trustworthy since the older Wi-Fi encryption protocols are attackable.
The second risk is that the hotspot device itself has been compromised. There are several ways in which this can happen including from the wireless network, the wired network and physical access. Another attack is spoofing the hotspot so users connect to the attacker's system rather than the legitimate service.
Rather than trying to assess the security of each wireless environment, I recommend that you become aware of the security of communication to each of the Internet services you use and move to TLS for anything that communicates information you would not want publicly disclosed. This habit should be followed for both wireless and wired connection since it can also protect against the (generally rare) attacks that expose data from the wired Internet.
It occurred to me to add a couple of disclaimers:
This discussion is about data in transit. Do not assume that your data is well protected at the destination service just because it was encrypted during transmission. That protection is lost once it arrives at the destination and other protections must be in place for the processing and storage of sensitive data at the remote site.
ALSO, you may have seen headlines about problems with TLS. Those are about specific implementations or older versions of the protocol. If the service provider has properly updated and maintained their system and you are using modern, updated software (such as keeping you browser software updated), TLS is a very powerful and entirely reliable protocol.