Passpoint vs captive portal: when each is the right sign-in

{{asset:header_image.png}}

Choose a captive portal if you need terms, consent and first-party data from visitors you meet once. Choose Passpoint if the same people return and should join automatically over IEEE 802.1X, the standard for authenticated, encrypted access. Most multi-site estates need both, and Purple Access runs them side by side on one platform.

Passpoint or captive portal: what is the short answer?

The choice turns on one question: do you already know who this person is? If they hold an identity before they arrive, Passpoint wins. That identity might be one of these:

• a staff account in Microsoft Entra ID
• a student record
• a resident key
• an OpenRoaming credential on their phone

If you meet them for the first time at the door, a captive portal wins. The portal is the only point where terms and consent appear on screen.

What each one is. Passpoint is the certification programme for Hotspot 2.0, which builds on the IEEE 802.11u amendment. A device finds a Passpoint network, matches a stored profile and authenticates without a single tap. A captive portal is a web page that holds a new device in a walled garden until the visitor signs in. The IETF captive portal architecture, RFC 8952, describes how devices detect and handle it.

They do different jobs. Passpoint replaces the login page for people you already trust. The portal earns trust from people you do not yet know.

On Purple Access they sit on separate networks:

• Open network: the captive portal.
• Secure network: Passpoint.
• xPSK network: a unique pre-shared key per device or resident, for hardware that supports neither.

On all three, identity sets the VLAN (virtual LAN), the network segment a device lands on.

Which criteria decide Passpoint vs captive portal?

We scored both options on eight criteria. Each one maps to a question an IT director faces after rollout. We used only what each option's own public material supports:

• Passpoint: the Passpoint programme and the WBA OpenRoaming material.
• Captive portals: the IETF RFCs and vendor portal documentation.

The eight criteria:

1. Join experience. How many taps a person needs on the first visit, and on every visit after it.
2. Over-the-air security. Whether traffic between device and access point is encrypted, and how.
3. Identity and segmentation. When the network learns who joined, and whether identity sets the VLAN automatically.
4. Consent and first-party data. Whether the join step can record terms acceptance and a marketing opt-in.
5. Device coverage. Which devices can join without help from IT.
6. Roaming. Whether one sign-in carries across your sites and partner networks.
7. Hardware fit. Whether the access points you own support it today.
8. Operating load. What your team maintains week to week.

Price is not a criterion here. Both options run as software on access points you already own, so cost is a question of structure. We cover that in its own section below.

How do Passpoint and captive portal compare?

The matrix scores each option on the eight criteria. The Purple Access column shows how we run both on one platform.

{"caption":"Passpoint vs captive portal on eight criteria","asOf":"2026-06-10","columns":[{"key":"c","label":"Criterion"},{"key":"p","label":"Captive portal (open network)"},{"key":"h","label":"Passpoint (secure network)"},{"key":"u","label":"Purple Access","highlight":true}],"rows":[["Join experience","Sign-in page on first visit and after session expiry","Profile installed once, then automatic","Both: portal on open, Passpoint on secure"],["Over-the-air security","None on plain open; Enhanced Open encrypts without identity","WPA2 or WPA3-Enterprise with 802.1X","EAP-TLS and cloud RADIUS on the secure network"],["Identity and VLAN","Known after sign-in, role applied then","Known before the first packet; RADIUS sets the VLAN","Identity sets the VLAN on all three networks"],["Consent and data","Terms and opt-in on screen at join","No join page; terms only via Release 3","Conscious-choice opt-ins; guest marketing in Engage"],["Device coverage","Any device with a browser","Current iOS, Android, Windows and macOS with a profile","xPSK for devices that support neither"],["Roaming","New sign-in at each venue","One profile across sites and 5 million+ OpenRoaming hotspots","Certified WBA identity broker; OpenRoaming free with Connect"],["Hardware fit","Splash settings on Meraki, Aruba, Ruckus, Mist, UniFi","Hotspot 2.0 settings on the same access points, firmware permitting","Hardware-agnostic cloud overlay, no new access points"],["Operating load","Portal pages, walled garden lists, CNA quirks","Certificates, profiles and RADIUS policy","Portal, cloud RADIUS and EAP-TLS in one platform"]],"footnote":"Scored from the Passpoint and OpenRoaming programme material, IETF RFC 8952 and vendor documentation. Purple figures are Purple's own data.","download":{"filename":"passpoint-vs-captive-portal.csv"}}

Encryption is the sharpest difference

A plain open SSID sends traffic between device and access point without encryption. Enhanced Open adds encryption through Opportunistic Wireless Encryption (OWE, RFC 8110), but it carries no identity.

Passpoint requires WPA2-Enterprise or WPA3-Enterprise. Every session authenticates over 802.1X using the Extensible Authentication Protocol (EAP). Each session gets its own keys.

Identity arrives at different moments

With a portal, the network learns identity late. The device already has an IP address and a browser session when it happens.

With Passpoint, the access point checks first. It asks a RADIUS server before the device sends its first data packet. RADIUS is the protocol access points use to ask an authentication server whether to admit a device.

That ordering decides what you can enforce. RADIUS returns a VLAN at authentication. A student, a contractor and a resident land on different segments without a second step.

{"kind":"lanes","direction":"lr","caption":"Two sign-in paths on the same access points","alt":"A captive portal holds the device in a walled garden until sign-in, while Passpoint authenticates over 802.1X before the first data packet.","lanes":[{"id":"o","label":"Captive portal on the open network"},{"id":"s","label":"Passpoint on the secure network"}],"nodes":[{"id":"o1","label":"Device joins open SSID","sub":"No encryption unless Enhanced Open","lane":"o","tone":"neutral"},{"id":"o2","label":"Walled garden","sub":"Traffic held until the portal is completed","lane":"o","tone":"neutral"},{"id":"o3","label":"Portal sign-in","sub":"Terms, opt-in and identity captured","lane":"o","tone":"brand"},{"id":"o4","label":"Access granted","sub":"Role or VLAN applied after sign-in","lane":"o","tone":"success"},{"id":"s1","label":"Device reads beacon","sub":"ANQP query for realm and roaming consortium","lane":"s","tone":"neutral"},{"id":"s2","label":"Profile match","sub":"Stored credential or OpenRoaming identity","lane":"s","tone":"neutral"},{"id":"s3","label":"802.1X to cloud RADIUS","sub":"EAP-TLS or EAP-TTLS, encrypted from the start","lane":"s","tone":"brand"},{"id":"s4","label":"Identity sets the VLAN","sub":"WPA2 or WPA3-Enterprise session","lane":"s","tone":"success"}],"edges":[{"from":"o1","to":"o2"},{"from":"o2","to":"o3"},{"from":"o3","to":"o4"},{"from":"s1","to":"s2"},{"from":"s2","to":"s3"},{"from":"s3","to":"s4"},{"from":"o3","to":"s2","label":"Onboard to secure","style":"dashed"}]}

Where does Passpoint win?

People who come back every day

Staff, students, residents and coworking members join the same networks daily. A portal asks them again whenever the session ends. Passpoint asks once, at profile install, and never again.

For a member, that is the seamless WiFi login they expect at home. For your helpdesk, it removes the repeat sign-in behind most portal tickets.

Encryption and identity before the first packet

Passpoint authenticates before any data flows. It uses EAP-TLS (certificate-based authentication), EAP-TTLS or SIM-based methods. Your security team gets evidence for who joined, when, and on which VLAN.

With Purple, cloud RADIUS checks each credential against Microsoft Entra ID, Okta or Google Workspace. Revoke the account and Purple revokes network access. Joiners, movers and leavers become policy rather than tickets. Our secure network guide to certificates, identity and Passpoint covers the full model.

Roaming between sites, cities and partner networks

The OpenRoaming vs portal comparison is starkest here. A portal works one venue at a time.

OpenRoaming takes a different approach. The Wireless Broadband Alliance (WBA) runs it to federate Passpoint networks, so one identity works at every member hotspot. Purple is a certified WBA identity broker, and OpenRoaming is free through the Connect licence.

{"items":[{"value":"5 million+","label":"OpenRoaming hotspots worldwide"},{"value":"53,000+","label":"students roaming in Newcastle","note":"Campus, city and trams"},{"value":"80,000+","label":"live venues on Purple","note":"Purple's own data"}]}

{"tone":"proof","title":"Newcastle: the world's first city-wide OpenRoaming network","text":"Purple runs Newcastle's city-wide OpenRoaming network. More than 53,000 students roam between campus, city and trams on one identity."}

If your security team asks what a visited network can see, point them to is OpenRoaming safe?

Devices that hide their hardware address

iOS and Android use a private, randomised MAC address per network by default. A portal that remembers devices by MAC address can lose track of them and ask again. Passpoint authenticates the credential, not the MAC address, so randomisation never triggers a repeat sign-in.

Where does a captive portal win?

First-time and one-off visitors

A hotel guest, a shopper or a fan at a single event has no profile on their phone. A portal lets them join from any browser. Asking that guest to install a profile first adds friction to a visit that may never repeat.

Consent, terms and first-party data

The portal is the only place where a visitor reads your terms and makes a conscious-choice opt-in. That record is evidence for GDPR consent. It also starts the first-party data your marketing team uses.

Purple's guest marketing runs in Engage. Our guest WiFi guide covers that side.

Passpoint Release 3 adds a terms-and-conditions acceptance step, but no marketing opt-in. See what changed in Passpoint Release 3.

Any device with a browser

Portals ask nothing of the device beyond a browser. Passpoint needs current operating system support and a profile. Older phones, visitor laptops and shared tablets often fall into that gap.

Portal detection is now standardised. RFC 8910 lets the network announce the portal through DHCP. RFC 8908 defines an API that reports portal state. Both reduce the captive network assistant (CNA) failures that drive tickets.

Onboarding to the secure network

The open network is also where you onboard personal devices to the secure network. A student signs in once through the portal and receives credentials. From then on, they join the 802.1X network. Used this way, the portal is the front door to Passpoint, not its rival.

{"tone":"warning","title":"Removing the portal removes the opt-in","text":"Passpoint has no page at the point of joining, so it cannot collect a marketing opt-in. Switch a guest SSID to Passpoint alone and new first-party data stops arriving."}

What does each cost to run?

Neither option needs new access points. The cost sits in licences, identity and people time. We describe the structure here, not amounts.

{"caption":"What each sign-in costs to run: cost lines, not amounts","asOf":"2026-06-10","columns":[{"key":"c","label":"Cost line"},{"key":"p","label":"Captive portal"},{"key":"h","label":"Passpoint"},{"key":"u","label":"On Purple Access","highlight":true}],"rows":[["Software licence","Portal platform licence","Cloud RADIUS, certificates and profile tooling","Connect, Capture or Engage plan"],["Hardware","None new on existing access points","None new; firmware upgrade if Hotspot 2.0 is missing","Hardware-agnostic cloud overlay"],["Federation","Not part of a portal flow","Optional OpenRoaming through a WBA identity broker","OpenRoaming free through Connect"],["Identity","Social, email or form sign-in","A directory you already license","Microsoft Entra ID, Okta, Google Workspace"],["Content upkeep","Page design, terms text, walled garden lists","Profile templates and RADIUS policy","Both run in one platform"],["Lifecycle work","Session timers and repeat sign-ins","Certificate issue, renewal and revocation","Revocation tied to the directory account"]],"footnote":"Cost structure only. Ask each vendor for amounts against your site and device count."}

On Purple, licensing runs by plan: Connect, Capture and Engage. OpenRoaming comes free through the Connect licence, so federation is not a separate line. Identity providers are usually licences you already hold. Passpoint for staff and students reuses directories you already pay for.

The hidden costs differ:

• Portals cost content upkeep and repeat-login support.
• Passpoint costs certificate lifecycle work: issue at joiner, update at mover, revoke at leaver.

Tie that lifecycle to the directory and it runs as policy, not as manual work.

What does moving from captive portal to Passpoint involve?

Moving is additive. You keep the portal SSID and add a secure network beside it. There is no rip and replace and no cutover weekend.

1. Check firmware for Hotspot 2.0. Confirm support in the Cisco Meraki dashboard, HPE Aruba Central, Ruckus SmartZone, Juniper Mist or the Ubiquiti UniFi Network application. Each vendor documents Hotspot 2.0 per firmware release.
2. Pick an identity source per audience. Use Microsoft Entra ID, Okta or Google Workspace for staff and students. Use OpenRoaming for visitors who carry an identity from elsewhere.
3. Stand up cloud RADIUS and certificates. Use EAP-TLS for managed and onboarded devices. Write the RADIUS policy that maps each identity to its VLAN.
4. Publish the Passpoint network. Set the Network Access Identifier (NAI) realm, roaming consortium and domain on the SSID. Take the values from your RADIUS provider rather than guessing them.
5. Distribute profiles. Use mobile device management (MDM) for managed devices and the open network for personal devices. OpenRoaming covers everyone else.
6. Measure the shift. Compare sessions on Passpoint against sessions on the portal at each site. Then tune portal session timers.

{"tone":"tip","title":"Run both SSIDs side by side","text":"Add the Passpoint network next to the existing portal SSID rather than replacing it. Devices without a profile keep the portal; devices with one move across on their own."}

Two guides go deeper on these steps:

• Becoming an OpenRoaming access network provider, for accepting visitors' OpenRoaming identities at your sites.
• Passpoint device support compared, for how iOS, Android, Windows and macOS handle profiles.

How should you decide?

Here is the decision rule. Use the portal when the relationship starts at the door. Use Passpoint when it started before the visitor arrived. Apply the rule per audience, not per estate.

{"title":"Passpoint or captive portal: which fits each audience","options":[{"name":"Captive portal","fitsWhen":["You meet most visitors once","You need terms and a marketing opt-in at the point of joining","Visitors bring devices you cannot provision in advance"],"notWhen":["The same staff, students or residents join daily","Your policy requires encryption on every connection"]},{"name":"Passpoint","fitsWhen":["People return and already hold an identity","You need encryption and identity before the first packet","You want one sign-in across sites and OpenRoaming partners"],"notWhen":["Your main goal is first-party data from first-time visitors","Devices cannot hold a profile"]},{"name":"Both on Purple Access","fitsWhen":["Your estate mixes guests, staff, students and residents","You want the open network to onboard devices to the secure network"],"notWhen":["Every device on site is managed and staff-owned"]}],"recommendation":"Keep the portal where you meet people for the first time, and move everyone you already know to Passpoint."}

Your next step is to list your audiences site by site: guests, staff, students, residents, members and contractors. Mark which already hold an identity. Those groups move to Passpoint, and the rest keep the portal. Then see how Passpoint and OpenRoaming run on Purple Access.

Frequently asked questions

Is Passpoint more secure than a captive portal?

Yes, over the air. Passpoint requires WPA2-Enterprise or WPA3-Enterprise with 802.1X, so every session is authenticated and encrypted before data flows. A plain open SSID with a portal encrypts nothing between device and access point. Enhanced Open adds encryption but no identity. A portal still gives evidence for consent, which Passpoint cannot. For OpenRoaming specifics, read is OpenRoaming safe?

Does Passpoint work on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist and Ubiquiti UniFi?

Yes. Each of the five documents Hotspot 2.0 settings on the SSID, subject to controller and firmware version. Purple adds cloud RADIUS and identity as a hardware-agnostic cloud overlay, so you need no new access points. Check each vendor's firmware notes for Hotspot 2.0 before you publish the network. Upgrade any sites running older releases first.

Can I collect marketing consent with Passpoint?

No. Passpoint has no page at the point of joining, so it cannot present a marketing opt-in. Release 3 adds terms acceptance, not consent to marketing. Keep a captive portal on the open network for first-time visitors, where conscious-choice opt-ins create first-party data. Purple's guest marketing runs in Engage. Returning visitors can then move to Passpoint, and you keep the consent records you already hold.

What does OpenRoaming cost with Purple?

OpenRoaming is free through Purple's Connect licence. You do not budget a separate federation line. Purple is a certified WBA identity broker, so your sites join a federation of 5 million+ hotspots worldwide through your Purple contract. Your choice of plan (Connect, Capture or Engage) sets the rest of the cost. OpenRoaming does not.

Can I run Passpoint and a captive portal on the same access points?

Yes. They run as separate SSIDs on the same radios: an open network with the portal and a secure network with Hotspot 2.0 enabled. Purple runs open, secure and xPSK networks on one platform, and identity sets the VLAN on each. Keep your SSID count low. Every extra SSID adds beacon overhead on every radio.

How much effort does moving from captive portal to Passpoint take?

Less than a hardware project, because you replace nothing. The work is identity and policy. You choose a directory per audience, stand up cloud RADIUS and certificates, enable Hotspot 2.0 and distribute profiles. The portal stays live throughout, so there is no cutover. Most of the effort sits in profile distribution, which depends on how many devices you manage through MDM.

Does a captive portal give audit evidence for GDPR?

It gives evidence for consent, provided the opt-in is a conscious choice and you record it. The portal shows terms and captures acceptance at the point of joining. Purple holds ISO 27001 and Cyber Essentials certification, which supports your supplier assessment. Passpoint gives a different kind of evidence: an authenticated identity and VLAN for every session.

Which devices support Passpoint?

Current releases of iOS, Android, Windows and macOS support Passpoint, but each installs and manages profiles differently. Older phones and headless devices often lack support or have no way to install a profile. xPSK fits there, giving each device or resident its own key on a segmented network. For platform detail, read Passpoint device support compared.