VPN on Library Wi-Fi: Your Laptop, Not Their PC

A cafe is a stranger AP and a skip you can name: you came for a menu. A school is a named account, a filter that exists to keep a classroom on task, and a PDF that can make a personal VPN a policy problem. A public library copies the splash and the filter, then adds a session clock, a card login, and a row of PCs that the next person will sit at in twenty minutes. Mixing those three in one sentence is how farms sell 'best VPN for public Wi-Fi' until the affiliate cookie expires.

The cafe habit still helps: get a real route, then start the tunnel, then open mail. The school habit still helps: read the posted rules. The library twist is furniture you do not own. Their desktop is not your seat. Their profile may already have a browser, a filter plugin, and a wipe-on-logout. Installing a VPN client on that box is how you leave an account, a config, and a mess for the next patron. I will not walk you through that install. I will tell you to stop.

I will not walk packet sniffing again. The public Wi-Fi how-to already did. I will not sell this branch a branded amenity. You are a patron with a backpack. Ask staff the SSID if two names appear. Do not pick 'Library_Free' because it sorted first in a hallway full of phones.

Farms will rank library Wi-Fi next to airports and hotels because the keyword is public. Public is not one product. A library is quieter, more filtered, and more likely to hand you a machine that is not yours. That is the whole point of this URL.

Library Wi-Fi often wants a card number, an 'I agree,' a guest voucher, or a click-through before you have a real route. Same garden as a cafe. If Smart Connect or a kill switch fires before the splash, you get no internet and no page. Disconnect. Pause fail-closed if traffic is bricked. Complete the garden. Confirm a boring site. Then connect Klox. WireGuard first. You will be naked on that LAN for a minute. That is the cost of the splash. I will not claim zero exposure.

Then the clock. Many branches cap a session: 60 minutes, 90 minutes, two hours if you re-authenticate. The tunnel does not freeze that timer. When the AP drops you, the splash returns. Kill switch will look like a broken internet. Pause, finish the page again, restore the tunnel. Do not sit there 'fixing Wi-Fi' while the person behind you wants the chair.

Some libraries keep a cookie so you skip the splash until closing. Some do not. If you already have a route, waiting is how mail fetches on library DNS. Connect. Do not perform a portal ritual that is not there. If you are not sure, load a plain site. If it hangs on a login, you are still in the garden.

Staff can reset a session. Staff can also tell you the SSID. Ask. A fake 'Library Guest' in a building full of students is still an evil twin. Encryption is not authentication of the branch. A tunnel on a twin is still a tunnel to a stranger.

The habit lives on a machine you brought. Phone. Laptop. Tablet you own. You install Klox from download. You sign in. You disconnect when you leave. The next patron never sees your profile. That is the whole security story that a public PC cannot give you.

A shared library PC is wiped, deep-frozen, or merely hoped to be wiped. You do not know which. You do not control the browser extensions. You do not control whether the last person saved a password. Installing a VPN client on that box means: an installer, a login, maybe a config file, maybe an auto-start that survives the 'guest' profile. Even if the freeze works, you spent twenty minutes configuring furniture. Even if it does not, you left a session. I will not give you the click path. The product is not for that chair.

Use the public PC for the catalog if that is the only machine that can reach a licensed database. Use it in the browser they already opened. Do not add software. For mail, banking, and anything with a password you care about, use your phone on cellular or your laptop on library Wi-Fi after the splash. If you have neither, skip the sensitive tab. The library is not obligated to be your office.

I have watched people type a banking password on a public PC 'because HTTPS.' TLS hid the page from the LAN. It did not hide the keyboard from a logger, a camera, or a sticky profile. A VPN would not have fixed that either. The fix is: do not do that on their PC.

Libraries filter. Children's areas filter harder. Guest Wi-Fi may be milder than the PC image. The posted acceptable-use text still exists: no illegal activity, no harassment, sometimes no circumvention of the filter. Read the sign. Read the page behind the splash. I am not a lawyer. This is not legal advice. It is product hygiene.

I will not coach bypassing content filters so you can watch blocked entertainment, hit torrent sites, or undo a protection the library is allowed to run. Connectivity when UDP dies is the only protocol advice here. WireGuard first. OpenVPN, often TCP, when the AP is rude. If both fail, the network does not want this hop. Cellular. Or accept the filter. Fighting DPI in a quiet room so you can ignore a children's-section policy is not a use I will staff.

A tunnel changes the destination the filter sees to 'a VPN server' if the handshake succeeds. That is why some branches block VPN. That is why farms sell obfuscation. I will not write an obfuscation cookbook for a public library. If the AUP forbids proxies and personal VPNs, stop. Stay on cellular. The seven-day window is how you undo a purchase you made for a room that does not want the hop.

Allowed to run a VPN for privacy on a rude LAN is not allowed to ignore every other rule. Copyright, harassment, and 'do not break the filter to abuse the network' still apply. If you needed a research database the library already licenses, use their path. A consumer tunnel is not a journal proxy.

A kill switch is fail-closed: if the tunnel dies, nothing else leaves. On a laptop at home that is often what you want. On library Wi-Fi it collides with the splash, the session clock, and a radio that drops when someone wheels a cart past the AP.

Deadlock looks like this. Auto-connect starts WireGuard. Handshake fails because the portal has not blessed you. Kill switch blocks the HTTP the portal needs. You toggle random settings. You tell a librarian the Wi-Fi is down. The product did what you asked. You asked for a brick until the tunnel exists. The tunnel cannot exist until the brick is lifted.

Pause the switch for the garden. Restore it after the tunnel is up if you still want fail-closed on a radio that will drop. If you cannot live with a pause, skip kill switch on library days and accept a leak window on drop. That is an adult trade. Pretending fail-closed and captive portals are friends is how tickets get written.

Library APs are small. They rate-limit. They reboot. Fail-closed will cut you more often than at home. That is not a defect in WireGuard. It is a branch with fifty laptops and a children's story hour on the same air.

A library table is usually two gadgets. Phone already on cellular or already tunneled. Laptop joining the branch SSID. That is two simultaneous seats if both tunnels are up. Klox is five. You can install in more places. Only five can be connected at once.

The tablet you left at home on auto-connect still counts if it is holding a session. Ghost phones count. A router at home holding a tunnel counts as one seat and then covers a house, which is a different article. For the library: disconnect what is not in your bag, or live with an error when the sixth handshake tries.

I research with phone plus laptop. That is the kit. I do not need a family seating chart to know two is two. If a partner's phone also joins, you are at three. Still fine. Count before you sit down, not after the error at a table with a time limit.

Remove retired devices in the portal. Sleep is not disconnect. A laptop lid can keep a peer. Open the app and look. Do not assume the library is why you hit the cap. The cap is often a tablet on the couch. The family seating piece is the spreadsheet if you needed names.

Without a tunnel: that you used their AP, roughly how much you transferred, IPs you hop to, often names in SNI or DNS. With a tunnel: that you used their AP, roughly how much, and a VPN endpoint. They may classify that endpoint as VPN and flag it. They do not get your mail body from that. HTTPS still hid the page on TLS sites. RFC 8446 is a lot of that encryption. Split 'they can see me' until it means one thing at a time.

A VPN hides the hop map from the library LAN by making the interesting hop 'a VPN server.' The library still sees that you associated. Cameras, card logs, a printer queue with your name: those are not VPN problems. If your threat is a person in the room, sit differently. If your threat is the LAN, tunnel. If your threat is the site, that is the site.

Phishing still works. A fake 'renew your card' page still works. The tunnel will encrypt the path to a thief if you typed the thief's URL. Unique passwords remain the account habit. The VPN is the path habit. Buy both or admit which one you skipped.

I will not claim no-logs as a way to hide from a library investigation you caused by abusing the network. Consumer no-logs is a different article. If you did something the posted rules forbid, a tunnel is not a time machine. Do not take this paragraph as a how-to for doing it anyway.

Stay on cellular if the posted rules forbid personal VPNs and you still wanted a hop that is not theirs. Stay on cellular if both protocols fail. Stay on cellular if the splash is a maze and the session clock is already at twelve minutes. Stay on cellular if the only machine you have is their PC and you need mail. Data caps are real. So is a leftover account on a public desktop. Pick the cheaper pain.

A phone hotspot can feed a laptop. That is two devices on your carrier, and it may still be one or two Klox seats if you tunnel on both. Count. Tethering in a quiet room is allowed in some branches and rude in others. Watch the sign. Watch the people trying to work.

Skip the tunnel on library Wi-Fi if you are only loading a catalog you would show a stranger and you accepted the hop map. Skip is allowed. Forgetting is not skip. Forgetting is how mail fetches on library DNS. If you cannot tell skip from forgetting, connect after the splash on a laptop you own, or stay on cellular so the choice is obvious.

If you bought Klox only for one research afternoon, the consumer window is seven days on first purchase. Live page: /refund. Renewals are not that window. I would rather you keep the year if libraries and cafes are a habit you will repeat. Yearly from $2.83 a month is not a printer fee. If you will not repeat it, refund inside the clock instead of leaving a subscription you resent.

WireGuard first. OpenVPN when the AP is rude. Apps on /download. Cafe habit if you wanted splash without a card. School habit if you wanted an AUP. Public-Wi-Fi how-to if you wanted sniffing. This page was the branch: clock, filter, your laptop, not their PC.