- Connect to WiFi.
- Complete the captive portal if there is one.
- Immediately turn on the VPN.
- Verify your IP changed at /tools/what-is-my-ip/.
- Browse normally.
Five steps, 30 seconds. The rest of this page is the longer explanation.
Why timing matters
The single biggest mistake people make with public WiFi and VPNs is treating "the VPN" as protection that's either on or off. The reality is more nuanced: there's a window between connecting to the WiFi and the VPN becoming active where you're exposed.
During that window:
- Background apps may sync or check for updates.
- Your email client may pull new messages.
- Cloud services may push notifications.
- Browser tabs you left open may refresh.
Most of this traffic is HTTPS, so it's not catastrophic. But the metadata (which services you use, what frequency, how much data) leaks to whoever's watching the network.
Minimizing the window means launching the VPN as the first thing you do after authenticating to the WiFi β not "after I check my email" or "after I finish what I was doing."
Step by step
Step 1: Connect to the WiFi
Use the most legitimate-looking SSID. If you're at a Starbucks, "Starbucks_WiFi" is more likely real than "Starbucks_Free_Faster." Ask staff if you're unsure β they'll tell you the correct SSID.
For password-protected WiFi, use the password the establishment provides; don't trust passwords scrawled on tables by previous customers.
Step 2: Handle the captive portal
Many public networks have a captive portal β the page that asks you to "Accept Terms" or sign in with email/social login. The captive portal works by intercepting your first HTTP request and redirecting you.
Two important things about captive portals:
- The VPN can't activate before the captive portal is complete, because the portal blocks non-HTTP traffic until you've authenticated. If your VPN tries to tunnel through, it'll fail. Don't fight this β complete the portal first.
- Don't enter credentials in the captive portal that you wouldn't want compromised. Captive portals are sometimes maliciously modified. If the portal asks for your work email and password, give it a junk email if possible, or skip the network.
Step 3: Launch the VPN immediately
The moment you're past the captive portal, open the VPN app and connect. On ClownVPN's Android app:
- Open the app.
- Tap the big connect button.
- Wait ~3-5 seconds for the tunnel to establish.
- The status indicator shows "Connected" with a server location.
If you've configured auto-connect on untrusted networks (recommended), the VPN starts automatically β you just need to confirm it succeeded.
Step 4: Verify
Open /tools/what-is-my-ip/ and confirm:
- Your IP shows the VPN server's address, not your real one.
- The location shows the VPN server's location.
- The ISP/ASN shows ClownVPN's network.
If the IP still looks like your real one (you can recognize this by the ISP showing as Comcast/Verizon/AT&T/T-Mobile rather than ClownVPN), the VPN didn't connect β repeat Step 3.
If you want a deeper check, run /tools/dns-leak-test/ to confirm no DNS leaks.
Step 5: Browse normally
With the VPN active, browsing on public WiFi is roughly as secure as browsing on your home network. The local network sees encrypted traffic to one endpoint (the VPN server) and nothing about your activity beyond that.
Settings to enable for public WiFi
Kill switch (always on)
If the VPN drops, the kill switch blocks all traffic until it reconnects. Without this, a VPN drop on public WiFi briefly exposes your traffic to the network.
On ClownVPN Android: Settings β Kill Switch β On.
Auto-connect on untrusted networks
Configure the VPN to automatically connect when you join any network that's not your home/work WiFi. This eliminates the human-error path of "I forgot to turn it on."
On ClownVPN Android: Settings β Auto-Connect β Untrusted WiFi β Configure trusted SSIDs (add your home network, office network, etc.).
Always-on VPN (Android system setting)
Android has a system-level "Always-on VPN" setting that ensures no traffic flows without the VPN active. Stronger than the app's kill switch (it survives app crashes, etc.).
To enable: Settings β Network & Internet β VPN β ClownVPN β Settings gear β Always-on VPN.
Block connections without VPN (Android)
Right below "Always-on VPN" there's a "Block connections without VPN" toggle. Enable this for the strongest protection β Android will block all network traffic if the VPN isn't active.
What this protects against, and what it doesn't
With the above setup on public WiFi, you're protected against:
- Passive packet sniffing.
- Metadata exposure (SNI, DNS, IP).
- Most evil twin AP attacks (traffic terminates at VPN exit, not local AP).
- Network-level DNS spoofing.
- SSL stripping on HSTS-non-preloaded sites.
You're not protected against:
- Attacks on your device (malware, keyloggers, OS vulnerabilities).
- Phishing β if you click a malicious link, the VPN doesn't stop you.
- Account-level surveillance β if you log into Google, Google knows it's you.
- Lateral attacks from other devices on the same WiFi (device firewall handles this, not the VPN).
Common pitfalls
- Connecting to fake SSIDs. "Free_Airport_WiFi" is almost always not the airport's official network. Check signage or ask staff.
- Skipping the IP verification step. The VPN app can show "Connected" while a configuration issue silently leaks traffic. Verify with a third-party tool.
- Using a sketchy free VPN to "save data." Reputable free VPNs are fine. Unknown free VPNs on public WiFi are worse than no VPN.
- Logging into sensitive accounts during the captive portal phase. Wait until the VPN is active. Your bank can wait 30 seconds.
- Forgetting to turn off the VPN when you leave. Not a security issue, but battery and connection-speed penalty. Configure auto-disconnect when leaving the network if you don't want this.