Four Adults, One Wi-Fi: Sharing a House Without Sharing Your Files

Home networking advice has one assumption buried so deep in it that nobody states it: everyone on the network is on the same side. Share the printer. Let the devices see each other. Put the password on the fridge. It is written for a family, and for a family it is right.

A house-share is not a family. Four people signed separate leases, three of them will be gone within two years, one of them is a friend of a friend, and the internet is in whoever's name was available on move-in day. Everything on that network can see everything else, because that is what the default is for, and nobody ever decided it — it just came that way. This is not about assuming your housemates are thieves. It is about the fact that a network built for mutual trust behaves badly the moment the household turns over, and turnover is the one thing a house-share is guaranteed to do.

What follows is city-neutral and applies just as well to a multi-generational house, a converted duplex, or a home you have taken a lodger into. None of it requires new hardware. Most of it is settings you already own.

Windows asks you a trust question at the front door, and it says so out loud

The single most important setting on a shared-house computer is one most people have never knowingly touched: whether Windows considers the network Public or Private. Microsoft's own description of the two is worth reading in its exact words, because the second one contains a condition nobody notices.

Public network: "Your PC will be hidden from other devices on the network. Therefore, you can't use your PC for file and printer sharing." Private network: "Your PC is discoverable to other devices on the network, and you can use your PC for file and printer sharing. You should know and trust the people and devices on the network."

That last sentence is the whole article. Microsoft is not describing a security level, it is asking you a question about the people in the building — and in a house-share the honest answer is that you know them and you do not entirely trust them, which is a perfectly normal thing to say about people you met on a listings site.

The good news is that the default is on your side. Microsoft states that "when you first connect to a network in Windows 11, it's set as public by default. This is the recommended setting." The bad news is that the default gets overridden constantly — by someone answering yes to a discoverability prompt, by a setup wizard, by whoever was trying to get the printer working last spring. The profile is remembered per network, so a laptop can be Public on the café Wi-Fi and Private at home without you ever having chosen either.

So check it rather than assume it. Settings, then Network & internet, then the network you are connected to, and set the network profile type to Public. Nothing you care about breaks: the internet works identically, your browser, email, streaming and cloud backups are all unaffected. What stops is other machines on the house network being able to see and reach yours. If you later need to send a file to a housemate, send it the way you would send it to anyone else — email, a shared link, a messaging app — rather than by leaving a door open permanently for a transfer that happens twice a year.

The Mac half, including the sentence that surprises people

macOS does not have the Public/Private switch. It has File Sharing, which is off by default and should stay that way in a shared house: System Settings, General, Sharing, and confirm File Sharing is off. While you are on that screen, Screen Sharing and Remote Login should be off too unless you deliberately turned them on and remember why.

If File Sharing is on — and it often is, because someone needed it once — Apple documents two behaviours worth knowing. The first: "The Public folder of each user with an account on your Mac is shared automatically." You do not opt in to that folder being shared; it is shared by virtue of the account existing.

The second matters most in the houses where one Mac is shared, or where you set a housemate up with their own login: "By default, any user set up on your Mac in Users & Groups settings can connect to your Mac over the network. A user with an administrator account can access your entire Mac." If you gave a housemate an account and left it as Administrator because it was easier, that is the sentence to sit with. Change them to Standard. It costs them nothing they actually use.

Where you genuinely do want to hand files around, Apple's per-folder permissions are better than switching the whole thing on: Read & Write, Read Only, "Write Only (Drop Box)" for a folder people can put things into but not look inside, and No Access. There is also an advanced option to "Allow guest users" on a shared folder, which in a house-share is the opposite of what you want.

On AirDrop, the setting is on the Mac as well as the phone, and it is the same fix on both: Apple's instruction is to "click and hold or click next to AirDrop, then click Contacts Only or Everyone." Contacts Only. Everyone is fine on a beach and unhelpful in a building where the person two rooms away can see you.

Can my housemate see what I am browsing? The honest answer is: it depends who bought the router

This is the question people actually search for, and the internet answers it with a shrug and a VPN advert. The real answer is specific and checkable, and it turns on one thing — whose name is on the router's admin login, and what brand it is.

Some consumer routers log and report browsing by design, because that is what parental controls are. TP-Link's own user guide for the Archer AX20 tells the account holder to "use the drop-down menu to view the websites visited and time spent online for any of the last 7 days," and to "click History to view a complete history." That feature is aimed at a parent looking at a child's device. It does not check the relationship. If your device has been assigned to a profile on a router with this switched on, the person holding the admin password can read a list of the sites that device reached.

Other vendors have taken the opposite position and say so plainly. eero's support documentation states that "eero software does not track your internet browsing activity — whether that is eero software on eero devices or eero Built-in devices."

So there is no general answer, only your answer. Find out what router the house has, and whether whoever set it up enabled profile-based parental controls or an activity log. And understand the mechanism, because it explains the limits: HTTPS protects the contents of a page, not necessarily the name of the site being contacted, which is precisely why a router can produce a list of sites at all. It sees where you went. It does not see what you read, what you typed, or your passwords.

A VPN on your own laptop genuinely does close this one — it hides your destinations from the router, and that is what it is for. Be clear-eyed that it closes only this one. A VPN does nothing about file sharing, nothing about an unencrypted disk, nothing about the account being in someone else's name, and nothing about the Wi-Fi password that four ex-housemates still know. It is the answer to one of the six problems on this page, which is roughly one-sixth of the reason it gets recommended.

Encrypt the disk, because the realistic threat is a bedroom door, not a hacker

Think about how a laptop in a shared house is actually compromised. Not by an intruder on the network. By being left on a desk in an unlocked room during a move-out weekend when the front door has been propped open for four hours and there are three people in the house nobody recognises. Or by being in a bag that gets taken. A login password alone does not help there — a drive pulled out of a machine and put in an enclosure reads back fine.

On a Mac the answer is FileVault, in System Settings under Privacy & Security. Turn it on, store the recovery key somewhere that is not the house.

On Windows the answer has a trap in it worth knowing, because the names have diverged. Microsoft: "Device Encryption is a Windows feature that enables BitLocker encryption automatically for the Operating System drive and fixed drives," and "unlike BitLocker Drive Encryption, which is available on Windows Pro, Enterprise, or Education editions, Device Encryption is available on a wider range of devices, including those running Windows Home." So a Home-edition machine is not locked out of encryption — it gets the same underlying protection under a different name and with fewer controls.

The trap is in how it switches on. Microsoft states that "when you first sign in or set up a device with a Microsoft account, or work or school account, Device Encryption is turned on and a recovery key is attached to that account. If you're using a local account, Device Encryption isn't turned on automatically." A lot of people deliberately set up a local account to avoid signing into a Microsoft account, and that choice quietly turns this off. Check yours: Settings, Privacy & security, Device encryption. If the toggle is not there at all, the hardware may not support it, which is worth knowing rather than assuming.

And whichever platform you are on: write the recovery key down and keep it somewhere outside the building. A recovery key stored only on the encrypted machine, or on a sticky note in the room, is not a recovery key.

The most over-shared credential in the building

The Wi-Fi password in a shared house has been given to every housemate, every ex-housemate, every partner of every housemate, several people who came to a party in 2024, a cleaner, two delivery drivers and at least one person nobody can identify. It has never been changed, because changing it means re-entering it on about thirty things and nobody wants to be the one who breaks the TV.

Change it anyway, and do it at a natural break — when someone moves in or out, which is when everyone expects a bit of disruption regardless. Then keep it changed by never handing it out again, which is what the guest network is for. Every router made in the last decade has one. Guests, visitors, a partner staying for a week, and the smart TV all go on the guest network with a different password you can burn at any time without touching a single one of your own devices.

One caveat so nobody wastes an afternoon: on many routers the guest network also isolates devices from each other, so anything you put on it that needs to be discovered — a printer, a streaming stick, a speaker — may stop being findable from the main network. That is the feature working, not a fault, and it is the reason the TV is a judgement call rather than an obvious yes.

The other half of this is the router's own admin password, which is a different password and is very often still the one printed on the sticker. Whoever holds that controls the parental-control logging described above, can see the device list, and can lock anyone out. In a house-share it should not be the sticker default, and it should be held by whoever is staying longest.

Whose name is on the account, and what leaves the house when they do

This is the part that turns into a real bill, and it is the part nobody thinks about until the person who set the internet up has already gone.

The internet account is a contract between the provider and one named individual. That person holds the login, the security PIN or passphrase used to authorise changes on the phone, the ability to cancel, and the liability for anything unpaid. Everyone else in the house is, as far as the provider is concerned, nobody. When they move out, three things can go wrong at once: the service can be cancelled from under the remaining housemates, the account cannot be changed by anyone still living there, and the leased equipment — which is in their name — is now sitting in a house they no longer live in.

The equipment half is the one that generates the horror stories. A rented modem or gateway that is never returned gets billed at replacement cost to the account holder, and an unpaid balance in a twenty-two-year-old's name is a credit-file problem for someone who is about to apply for a car loan. If any of the kit is rented, it goes back with a tracking number or a receipt, and the receipt gets kept.

Providers do have processes for transferring account ownership from one person to another. Check your own provider's specific route before you need it — and note the timing, because in practice these transfers involve the person currently named on the account. That is exactly why this is a move-in job rather than a move-out job. Do it on day one, while everyone is still cheerful and reachable, and put the account in the name of whoever expects to be there longest.

The same logic applies to anything else billed to the house. A shared streaming subscription is one person's payment card and one person's password, and when they leave both go with them. Not a disaster, but worth a five-minute conversation before it becomes an argument.

The shared printer, and the devices nobody owns

A printer on a flat house network is available to everyone on that network, which is usually fine and occasionally not. If you are printing a lease, a tax return or a medical form, be aware that the machine sits in a common room, that whatever came out of it stays in the tray until someone collects it, and that on many models a job sent while it is offline will queue and print later — sometimes much later, in front of an audience.

The general principle for the house: shared devices belong to the house, personal devices belong to a person, and it is worth being deliberate about which category each thing is in. A network drive or an always-on media server in a common area is a house device and should not be doing double duty as somebody's backup. Which leads to the last one.

Back up somewhere that is not the house

Every argument for off-site backup gets stronger in a shared rental. The external drive on the desk shares the room with the laptop, so a theft takes both. A leak in an unfamiliar building, a kitchen fire, a housemate's move-out van and a landlord's emergency entry are all house-level events, and a house-level event takes everything inside the house at once.

So the backup that counts is the one somewhere else: a reputable cloud backup service running automatically, or at minimum a drive that lives at a parent's house or an office and gets swapped periodically. If you keep a local drive as well — and it is a reasonable thing to do, because restoring from local is much faster — keep it encrypted, because an unencrypted backup drive in a shared house is a copy of everything on your computer with no password on it at all.

Worth naming what is actually on a student or young-professional laptop, because people underestimate it and then discover it the hard way: the tax returns, the loan paperwork, the financial-aid file, the passport scan, the photographs, and the coursework or portfolio that represents years of work and exists in exactly one place.

The list, in the order we would do it

Day one, and it takes about half an hour. Set your Windows machine to Public on the house network and confirm Mac File Sharing is off. Turn on FileVault or Device Encryption and put the recovery key somewhere outside the building. Change the Wi-Fi password and the router admin password, and put the account and the router in the name of whoever is staying longest. Stand up the guest network for visitors and the TV. Get an off-site backup running.

Then the two ongoing habits. Change the Wi-Fi password every time someone moves out, not eventually. And when a housemate goes, do the account and equipment handover that week, while they still answer the phone.

How we can help

Most of this is settings, and settings are the sort of thing that is quick when someone has done it a hundred times and a lost evening when you have not. We will go through a shared house end to end: network profiles on every computer, sharing and remote access switched off where it should be, disk encryption on with the recovery keys recorded somewhere sensible, a guest network that actually works, and a backup that runs without anyone remembering to run it. Remote support covers nearly all of it.

We also do the awkward half — working out what a particular router is logging and who can see it, sorting out a house where the internet is in the name of somebody who left in June, and getting the printer and the streaming devices back on speaking terms after a network gets tightened up.

We look after homes and small businesses across Southern California, and this comes up everywhere the housing stock is ordinary houses rented by unrelated adults: near UCR in Riverside, in Long Beach and Glendale, and in every family home that has taken in a lodger or turned a garage into a room. We do not sell hardware and we get nothing from any provider, so the advice is just the advice.

Bottom line

Your Wi-Fi was configured for a household that trusts each other, and Microsoft says so in writing — the Private network profile comes with the condition that "you should know and trust the people and devices on the network." A house-share is the ordinary, unremarkable case where that condition is not met, and nothing about the network knows it.

Six changes fix nearly all of it. Set the network profile to Public and turn Mac file sharing off, so your computer stops advertising itself indoors. Encrypt the disk, because the real threat is an open door on a move-out weekend. Change the Wi-Fi password and use the guest network for everyone who is not you. Find out what your router logs and who holds its admin password. Put the internet account in the name of whoever is staying, and get the rented equipment back with a receipt. Back up somewhere that is not the building.

None of it says anything about your housemates. It says that a network should not depend on a level of trust that a twelve-month lease was never designed to produce.