English

Public Wi-Fi and a VPN: a practical checklist

Public Wi-Fi is often a convenient way to get online while travelling or working away from home. A useful preparation process starts before you join the network: know which connection you intend to use, keep the device ready and understand what your VPN actually protects.

A VPN provides an encrypted tunnel between your device and a VPN server for connections routed into it. It is one part of a connection, alongside the device, the local network, the destination and the accounts you use. It does not establish that a hotspot is genuine, that a website is trustworthy or that every application is using the tunnel.

Prepare while you have a familiar connection

Install the supported app and review its ordinary connection process before you need it elsewhere. Downloading an unfamiliar installer in a hurry makes it harder to check the source, version and expected behaviour.

For ZARDO, consult the download page for the current Android release and platform status. The Android update path checks the update file's checksum, package identity, version and signing certificate before opening the system installer. Those checks are useful to understand, but they do not justify accepting an arbitrary installer from another source.

Make sure you can access the account information you need without leaving credentials visible to other people. If you use optional saved sign-in, remember that convenience and physical device access are separate considerations. An unlocked device still needs appropriate care even when a saved password is encrypted at rest.

Confirm which network you intend to join

A network name is a label, not proof of who operates it. Where a venue provides access, ask for its actual network name and connection instructions rather than guessing from the list of nearby networks.

If a network presents a sign-in or acceptance page, read what it asks you to do. Do not enter an unrelated account password because the page uses a familiar logo. Do not install a certificate or a new application merely because a hotspot page requests it without a clear, trusted reason.

Separate the local access step from the VPN step. A network may need its own ordinary connection process before internet access is available. If the VPN cannot connect, note whether the device had ordinary internet access first, rather than repeatedly changing the app and the network together.

Understand the two encryption layers

The VPN tunnel protects traffic routed between your device and the VPN server. After the tunnel endpoint, the connection continues towards the destination. HTTPS is a separate layer protecting a website connection; it remains relevant when a VPN is in use.

Check the website address before entering sensitive information. Treat an unexpected certificate warning as something to investigate, not as a routine consequence of travelling. A connected VPN indicator is not permission to ignore the browser's warning or to enter credentials into a page whose identity you cannot establish.

ZARDO uses AmneziaWG, a WireGuard-based protocol, with ChaCha20-Poly1305 authenticated encryption and Curve25519 key exchange. This describes tunnel protection. It is not a promise that every item displayed by every app is safe or that every connection takes the same route.

Review app exclusions and routing

In ZARDO, the routing mode and app exclusions determine which connections use the encrypted tunnel. An excluded app or connection can use the normal internet connection. Review these settings before assuming that a particular task is covered.

For example, if you intentionally excluded an app at home, that selection should not be forgotten when using another network. The fact that the VPN is connected does not itself change the meaning of an exclusion. Check the intended route for the task you are about to perform.

Do not use one successful page load as proof of system-wide leak protection. Dynamic phone leak validation remains open for the reviewed release. A practical connection check can tell you whether a task worked in that situation; it cannot establish an untested guarantee about all DNS, IPv6 or application traffic.

Know what happens if the tunnel disconnects

The current ZARDO Android release does not support Android Always-on VPN or “Block connections without VPN”. It does not guarantee that internet access stays blocked when the VPN disconnects. This is a material limit when deciding whether the app fits a particular situation.

Keep that behaviour in mind during interruptions, network changes and manual disconnection. A previous connected state does not prove that the current task is still using a tunnel. Check the app state rather than relying on a connection established earlier in the day.

If you need a guarantee that traffic remains blocked outside a VPN connection, do not infer it from the existence of encryption. Review the actual supported safeguards and their validation status before proceeding with a task that depends on that guarantee.

Leave with the device in an understood state

After finishing, check whether the VPN is connected or disconnected as you intend. Review whether the device will automatically rejoin that Wi-Fi network later, using the device's own network settings. Avoid leaving an unfamiliar installation permission enabled if you granted it during setup.

If you encountered a problem, keep a short description: network type, app version, connection stage and visible error. Remove credentials and unnecessary identifying details from any support material. A specific description is easier to assess than a collection of repeated connection attempts with no record of what changed.

Finally, a VPN service also handles operational data. ZARDO retains account, device, connection and diagnostic records and does not operate under a zero-logs policy. Read the privacy information to understand that side of the connection, and use the pricing page only after you have considered the supported platforms and technical limits.