Cafe Wi-Fi Privacy Kit

Disclosure: Kit & Key is an independent privacy-stack site. Some links on this page are affiliate links. If you buy through them, we may earn a commission. That does not change the price you pay. It does change which paid tools we can recommend with a straight face. Mullvad and Bitwarden are unpaid controls. We do not earn anything when we point you there.

Cafe and hotel Wi-Fi is a network you do not control. Other laptops, phones, the shop’s gear, and whatever is plugged into the same router share it. Treat it as untrusted. You do not need a thriller. You need three tools that stay on while you work: a VPN to encrypt the path off that network, a password manager so you never type a reused password into a browser, and antivirus so a bad download does not become a bad week. This is the kit. Install it once at home. Use it every time you sit down with a laptop and a coffee.

The kit

Install in this order. Password manager first, antivirus second, VPN last. The manager gives every other account a unique password, including the VPN. Antivirus covers the machine before you start tunneling. The VPN is the last layer you turn on, so you can finish account setup on a network you already trust.

1. Password manager: 1Password, or Proton Pass

On public Wi-Fi, the failure mode is not only sniffing. It is typing the same client-portal password you use everywhere into a browser on a network you just joined. A password manager stops that. It stores unique passwords. It fills them. You stop reusing anything.

Default pick: 1Password. It is the freelancer tool. Shared vaults for a contractor or a small team. Travel-ready apps. A clear desktop workflow. If you work from cafes and send invoices, this is the one that fits the job.

If you already want Proton: Proton Pass. Same company as the VPN pick below. Fewer vendors to keep track of. Fine for a solo laptop-and-phone setup. Weaker than 1Password if you share a lot of logins with other people.

Unpaid control: Bitwarden. Open source. A strong free tier. You can self-host if that matters. We do not earn a commission on it. If you want the privacy-maximalist password manager and you are willing to live with a plainer app, use Bitwarden.

Turn on the browser extension and Autofill. Generate a new unique password for email, banking, and any client tool you will open on cafe Wi-Fi. Do that before you leave the house.

2. Antivirus: Malwarebytes

A VPN encrypts traffic. It does not scan the file you just downloaded. It does not stop a malicious document from a “client” who found you on LinkedIn. Antivirus is the piece that watches the device.

Pick: Malwarebytes. Straightforward on Windows and Mac. It is here to catch malware, PUPs, and the obvious bad download. It is not a privacy tool. Do not expect it to hide you. Expect it to reduce the chance that an untrusted network plus a careless click becomes a compromised laptop.

Real-time protection is Malwarebytes Premium Security (or the trial). Malwarebytes Free is still a scan-and-cleanup tool. It is not always-on antivirus. On Windows and Mac, turn Real-Time Protection on after install if it is not already on. On Mac, grant Full Disk Access first or the layers stay inactive. Run one full scan at home so you are not doing that on cafe bandwidth.

Keep the OS and browser updated. Malwarebytes does not replace that.

3. VPN: Proton VPN (NordVPN if you want the other paid pick)

The VPN’s job on cafe Wi-Fi is narrow and important. It encrypts traffic between your device and the VPN server, so the local network cannot read it. Turn on the kill switch so a dropped tunnel does not dump you onto the raw cafe network. That is the whole point of this layer.

Default pick: Proton VPN. Swiss company. Open-source apps. Kill switch and always-on options. Ten devices on paid plans. It sits next to Proton Pass and, if you want it later, Proton Mail. For a privacy-stack site, this is the paid VPN that matches the rest of the kit.

Other paid pick: NordVPN. Use this if you want Nord’s app and Threat Protection more than you want the Proton ecosystem. Same job: encrypt the path, Internet Kill Switch on, Auto-connect set to On Wi-Fi networks. Ten simultaneous devices.

Family or unlimited-device fork: Surfshark. One subscription, unlimited devices. Right call if the same login covers a household, a travel laptop, a phone, and a tablet. Nord Security and Surfshark merged in February 2022. They run as separate products. They are not independent of each other. If that overlap bothers you, stay on Proton VPN or the unpaid control below. Need this for a household, not a laptop? See the family kit.

Unpaid control: Mullvad. No affiliate program. They do not pay us, or anyone, to mention them. Account is a number, not an email. Five simultaneous connections. Flat monthly price. If you want the privacy-maximalist VPN and you do not need a big-brand app, use Mullvad. We earn nothing from that sentence.

Proton Mail is not part of this kit’s install list. Mention it once, honestly: a VPN encrypts the path, not the mailbox. If you read client email on cafe Wi-Fi and you care who holds that mail, Proton Mail is the next step. It is not required to make the three-tool kit work.

10-minute setup

Do this at home, on a network you already trust. Then take the laptop to the cafe.

Minutes 0–3: password manager. Install 1Password or Proton Pass. Create the account. Install the browser extension. Turn Autofill on. Save a unique password for email. Save a unique password for the VPN you are about to install. If you still log into client tools with a reused password, change those two or three now. The rest can wait.

Minutes 3-6: antivirus. Install Malwarebytes. Use Premium or the trial if you want real-time protection. Free is scan-only. Start a full scan and let it run in the background. You do not need to watch it.

Minutes 6–10: VPN. Install Proton VPN (or NordVPN / Surfshark). Log in with the unique password you just stored. Then set three things:

1. Kill switch: on. Proton calls it Kill switch. On Windows, Standard is the default mode; Advanced is not on Mac. NordVPN’s Windows name is Internet Kill Switch. If the tunnel drops, traffic should stop, not fall back to the cafe network.
2. Auto-connect: Proton Windows is Auto startup. Proton Mac is auto connect when the app starts. NordVPN is Auto-connect, set to On Wi-Fi networks (or On all networks). Proton has no consumer setting named untrusted networks.
3. Protocol: leave the default (WireGuard / NordLynx). Do not hunt for a “faster” protocol in a cafe.

Connect once at home so you know the app works. Disconnect. You are done.

At the cafe, in order. Join the Wi-Fi. Complete the captive portal (“Accept” / room number / email). Then connect the VPN. Then work. If Kill switch or Internet Kill Switch is already blocking all non-VPN traffic, the portal page may not load. That is expected. NordVPN’s own Kill Switch page says public Wi-Fi sign-ins may require turning it off briefly. Portal first. Tunnel second.

Do not type passwords by hand. Let the manager fill them. Do not turn the VPN off to “make Slack faster.” If a site misbehaves, switch servers. If it still misbehaves, use your phone as a hotspot for that one task. Leaving the tunnel down on cafe Wi-Fi defeats the kit.

What this kit does not do

This is a cafe-Wi-Fi stack. It is not a new identity.

• It does not make you anonymous. The VPN hides your traffic from the local network. The VPN company can still see that your account is connected. Sites you log into still know who you are.
• It does not encrypt your mailbox. Gmail on a VPN is still Gmail. Proton Mail is the extra step if the contents of email matter.
• It does not stop phishing. A password manager helps, because it will not fill a password on the wrong domain. It will not save you from pasting a one-time code into a fake page.
• It does not replace updates. Unpatched OS, old browser, ignored Mac/Windows updates. None of the three tools fix that.
• It does not protect a laptop that is already compromised. If malware is on the machine before you install this, a VPN will encrypt its traffic too.
• It does not hide that you are using a VPN. The cafe can still see an encrypted tunnel. That is fine. You are not trying to look like you are not using one.
• It does not secure the other people on your accounts. Shared Netflix, a partner on the same password, a contractor with yesterday’s docs link. Those are account problems, not Wi-Fi problems.
• It does not replace disk encryption or a screen lock. Close the lid. Use a password or Face ID. FileVault / BitLocker is a separate, free control. Turn it on at home if it is not on already.

If you only do one thing from this page: password manager plus VPN kill switch. Antivirus is the third leg. Skipping it is how a “quick PDF from a new client” becomes the week you reinstall the laptop. If cafe Wi-Fi is only one day a week and the rest is a home office plus clients, see the freelancer stack.

Ownership and how we get paid

Kit & Key is independent of the product companies in this kit. We are not ExpressVPN, Nord, Proton, or anyone else on this page.

That matters because a lot of “best VPN” lists are not independent. Kape Technologies owns ExpressVPN, CyberGhost, and Private Internet Access. It also owns review sites in the same neighborhood, including vpnMentor. Those sites can review the same company’s products. We do not. We do not rank a sister-brand VPN as #1 because it shares a parent with the publisher.

Nord Security and Surfshark merged in February 2022. Official wording is a merger, not an acquisition. We mention both in this kit because the jobs differ (ten devices vs unlimited). We mention the parent so you can decide if that overlap matters to you.

Affiliate links: Proton VPN, NordVPN, Surfshark, 1Password, Proton Pass, Malwarebytes, and Proton Mail. If you buy through those links, we may earn a commission.

Unpaid controls: Mullvad (no affiliate program; they do not pay for mentions or links) and Bitwarden (we treat it as a control, not a paid pick). If the maximalist option is the right one for you, use it. We wrote it in anyway.