Public Wi-Fi safety, explained by what actually goes wrong

A captive portal is the sign-in page a cafe, hotel or train pushes at you before it lets any traffic out. Technically it is a gateway that answers every name lookup with its own address and redirects unencrypted web requests to its terms page. Until you accept, the only thing on the network you can reach is the portal itself.

This is why a VPN looks broken on a network you have just joined. A WireGuard tunnel comes up by exchanging a handshake with the server it is configured for, and the gateway drops that handshake along with everything else. Nothing is wrong with the app; there is simply no path to the internet yet for it to use.

So the order matters. Join the network, let the portal open, give it whatever the venue legitimately needs, confirm you have a working connection, then bring the tunnel up. The seconds between joining and connecting are the one window where your ordinary traffic sits on the raw network, which is a good reason to keep that window short and not open your mail while you wait.

Nearly everything is HTTPS now, and that genuinely is most of the problem solved. Someone listening to the air between your laptop and the access point cannot read the body of a page, a message you sent or a form you submitted. That part is finished, and it is not where the remaining exposure lives.

What still travels in the open is addressing. Your device looks up a hostname before it connects, and unless both your device and the network happen to be using encrypted DNS, that lookup is a readable question. The TLS handshake then names the site again in its Server Name Indication field, which stays unencrypted even in TLS 1.3 unless Encrypted Client Hello is supported at both ends. Add destination addresses, which are unavoidable, plus packet sizes and timing, and an observer has a timestamped list of the services you used without decrypting a single byte.

A network name is a string broadcast by a radio. Nothing registers it, nothing verifies it, and nothing prevents a second device in the same room from broadcasting the same one. That is an evil twin: an access point advertising a familiar name so nearby devices treat it as somewhere they have already agreed to trust.

What makes it work is a convenience you asked for. Phones and laptops remember networks by name, rejoin them without asking, and prefer whichever signal is strongest. A radio sitting two metres from your table is stronger than the router behind the counter, so the decision is usually made before you look at the screen. Everything after that is ordinary operation: whoever runs the access point runs the DHCP server, chooses your resolver, and sees every address you try to reach.

This is the one threat here that a tunnel handles cleanly, because a WireGuard peer is authenticated by its key, not by the name of the network the packets crossed. If the handshake completes, the far end is the server you configured. A hostile access point in the middle can refuse to carry the connection, but it cannot be the other end of it.

Venue Wi-Fi is usually WPA2 with one pre-shared key printed on a receipt or a chalkboard. The encryption is real, and it is better than an open network, but the key is shared, and a secret a hundred guests know is a secret in name only. Someone who has that password and is capturing the air at the moment your device joins can derive the keys for your session, because they come from the handshake plus the key they already hold.

There is a second, quieter consequence of joining. You are now on a local segment with strangers, and anything your device offers its neighbours it is offering to them: file shares, screen sharing, a discoverable printer, a media server, a development server left running on a laptop port. At home that behaviour is a feature, which is exactly why it is easy to forget that it travels with you.

With WrapVPN connected, your device builds one encrypted connection to a server you pick and sends everything through it. The access point, and anyone listening to it, sees a single stream to a single address. The name lookups and TLS handshakes that were readable a moment ago now happen at the far end instead.

Two details matter on poor Wi-Fi specifically. WireGuard completes its handshake in a single round trip, so the reconnect after a train enters a cutting, or after a hotel hands your laptop to a different access point, is quick rather than a visible stall. And because ad and tracker filtering happens at the DNS layer, those domains are refused before your device contacts the host at all, which on a congested shared link removes requests you were never going to look at.

A reconnect is also the moment a tunnel could leak, and a shared network gives you a great many of them. That window is what the kill switch covers: when the tunnel drops, traffic stops at your device instead of falling back to the open network, and DNS and IPv6 stay pinned inside the tunnel until it is back. It is enforced at the system level rather than by the app, so it holds whether or not a WrapVPN window is open. On a network that drops every few minutes, the difference is whether each drop costs you a pause or spills a few requests onto the access point in the clear.

One account covers iPhone, iPad, Mac and Android, with a Windows build in review, which is relevant here because the laptop is usually the device with sharing enabled and the phone is the one that rejoins networks by itself. The pricing fits the shape of the problem too: $1.99 per week or $3.99 per month, with no annual subscription, so a week of hotel and cafe networks does not need a year-long commitment.

A tunnel is transport security. It makes the network you are standing on irrelevant to your traffic, and that is the whole claim. Threats that do not care which network you are on are untouched by it.

A phishing page reached through a tunnel is still a phishing page, and the encryption works perfectly while you type your password into it. A file you choose to download and run arrives just as faithfully. If the device is already compromised, whatever is on it saw what it wanted before the tunnel existed. And a reused password that leaked somewhere else is equally a problem on hotel Wi-Fi, at home, and on a cellular connection.