VPN for hotel Wi-Fi: a network you live on for days

Duration is the whole difference. A tunnel that comes up once and then runs for four nights meets things a brief session never does: a lid closing and opening, a phone dropping into a sleep state and waking to a fresh lease, a corridor access point restarting at some quiet hour, and the property's own sign-in cycle lapsing somewhere in the middle of the stay.

The wake is the moment worth planning around, because a device wakes onto the hotel network first and into protection second. Auto-Connect on Wi-Fi, in Settings, is what closes that interval: the tunnel comes back as part of joining the network rather than when you next think to look at the app. Left off, the seconds after a lid opens are ordinary readable traffic, and a laptop that has slept all afternoon opens with mail, calendar and file sync all asking at once.

On a long stay the session timer on the main screen earns its place, because its Connected for readout counts the current session rather than the trip. A timer reading a few minutes when you left the tunnel up overnight means it re-established itself at some point, which is usually a sleep cycle or the access point rather than anything you did, and Session History is where that gets confirmed instead of guessed at.

Most hotel portals authenticate a room rather than a person. Surname plus room number is the usual pair, occasionally an arrival date in place of one of them, and the combination is weak in a specific way: room numbers are printed on the doors, and a surname is the single detail a stranger standing near the front desk is most likely to overhear. Another guest guessing their way onto your allowance is a mundane event rather than a sophisticated one.

The same arrangement labels the session. The operator is not looking at an anonymous device on the segment; it is looking at the device registered to a room, and the destinations that device reached can be lined up against the folio paying for the stay. A tunnel cuts the second half of that and not the first. You handed over your name at check-in, so the property still knows which room is online, but what the room did becomes a single encrypted session to one endpoint.

The portal cannot live inside the tunnel. Until the terms are accepted the gateway forwards nothing, so a handshake has nowhere to land. Join the Wi-Fi, let the sign-in page finish, watch one ordinary page load, and only then bring protection up.

Then expect to repeat it. Hotel sign-in sessions commonly lapse on a daily cycle, or when the property clears its session table, and on the third morning the page can reappear with no warning while the app still reports a live connection, because the device never actually left the network. The symptom is protection that says it is on and carries nothing. The cure is to open a plain page, re-enter the same room details, and let the tunnel come back.

Hotel Wi-Fi is one of the last places where the number of devices you packed is a billing question. The familiar arrangement is a deliberately slow free tier limited to one or two devices per room, a faster tier sold per device and often per night, and a separate rate for meetings and events. A family arriving with four phones, two tablets and a laptop reaches the cap before dinner.

This is where one account covering unlimited devices stops being a line on a pricing page. The hotel's allowance is a property of the room; a WrapVPN plan is not. What you negotiate at reception is how many of your devices get an address, while every device that has one is protected without buying anything further. The plan lengths fit a stay as well: $0.99 for a day, $1.99 a week, $3.99 a month, a 7-day free trial on the monthly plan, and no annual subscription to carry home afterwards. The free tier is not built for this, at 3 hours a week with a 1-hour session cap on two devices, which is a test of the app rather than cover for four nights.

One gap belongs in this section rather than in small print, because this page keeps talking about the laptop on the desk. The released apps are iPhone, iPad, Mac and Android; the Windows build is in review rather than shipped. So if the machine you intend to work from all week runs Windows, it is the one device the hotel will happily register and WrapVPN cannot yet protect, and the realistic plan for a working stay is to keep anything sensitive on the phone, tablet or Mac until that changes.

What no tunnel does is get you past the cap, and that should be said plainly. The allowance is enforced at the gateway, by device, before any of your traffic reaches a server, so protection is simply irrelevant to it. The honest ways round are dull ones: ask the desk to register the extra devices, which many properties will do for a longer stay without charging, pay the per-device rate for the one or two that genuinely need the faster tier, or put the overflow on your own phone hotspot and keep the tunnel running on that.

A terminal network is a crowd you walk through. A hotel network is a neighbourhood you sleep in, and at a good number of properties it is a flat one: guest devices sharing a segment, able to see one another, with nothing isolating one room from the next. If your laptop can discover the printer in the business centre, something in another room can discover your laptop.

That matters because the contents of a suitcase are configured for home. A laptop with file sharing left on, a tablet offering its photo library to a living-room speaker that is three hundred miles away, a media server, a development server bound to every interface because that was convenient on Tuesday: each of them announces itself to the segment on joining and keeps announcing for the length of the stay.

The division of labour is worth being exact about. The tunnel protects traffic leaving the device for the internet. It does nothing about a service the device is advertising to its neighbours, because that traffic never goes near an exit at all. That half is the operating system's job: mark the network as public rather than trusted, switch sharing off before you pack, and turn off local discovery you are not using. It is a far easier job at home than in a dark room at midnight.

Guest Wi-Fi is capital equipment inside a building, and buildings are refurbished on a slower cycle than radios are replaced. It is ordinary to meet access points several generations behind the phone in your hand, mounted where the cabling already ran rather than where coverage would be best, with a structural wall between them and the bed. One bar in a corner room is usually the geometry of the building, not a fault anyone can clear.

Demand then arrives all at once. Backhaul is sized for an average, and the average is not the evening, when most of the house is upstairs at the same time. A connection that felt unremarkable at breakfast can be hopeless after dinner, and encryption neither causes that nor cures it, because the shared uplink is the ceiling for every room on the floor.

The third thing to know is who you are actually talking to. Guest networks are very often run under contract by a third party, which is why the desk can reset your registration but cannot explain a routing fault, and why the support number on the portal answers in a company name you have never seen. If the connection is broken rather than merely slow, the sentence that gets results at reception is a request to re-register the room on the system.

The thing that most often actually goes wrong in a hotel room has nothing to do with the network. A guest signs a video or music account into the room's smart television, watches something, checks out, and leaves the session live for whoever sleeps there next. Televisions sign out when they are asked to, and housekeeping is not asked.

Here is the honest part: a VPN does nothing about this. The television is a separate device, it is not inside your tunnel, and an account you typed into it stays signed in regardless of what your phone is doing. The fix is account hygiene, carried out from your own phone before you leave the room: sign the session out on the set itself, then use the account's own sign-out-everywhere control, which is the one that catches a television you have already walked away from.

Not signing in at all is the better habit. Playing from your own device keeps the credential on hardware you are taking home, and it is worth knowing what usually breaks that: the room network may refuse to pass traffic between your phone and the set, and a tunnel on the phone can stop the two discovering each other as well. The Pause control exists for exactly this kind of short exception: it asks how long — 1, 5, 15 or 30 minutes, beside the option of disconnecting completely — and the dashboard then reads Protection Paused with the time counting down, so it comes back by itself instead of staying off for the rest of the trip.