Captive portal
Also known as: Wi-Fi login page, Wi-Fi splash page, hotspot login page, captive Wi-Fi portal
A captive portal is a web page that appears when you connect to certain Wi-Fi networks, such as at hotels, airports, cafés, and libraries, asking you to accept terms, enter a room number, watch an ad, or log in before you can use the internet.
The network 'captures' your traffic until you complete the step. While captive portals are a normal part of public Wi-Fi, fake networks can mimic them to steal passwords or personal information.
Captive portal, explained at three levels
At home
A captive portal is like a doorman at a hotel. You can walk into the lobby, but you cannot go upstairs until you sign the guest book. On public Wi-Fi, you join the network, but the router blocks your internet traffic and sends you to a web page first. Once you accept the terms or log in, the router adds your device to its allowed list and lets you through.
At work
A captive portal is a web page a guest Wi-Fi network shows before granting internet access. Businesses use it to display terms of use, collect consent, charge for access, verify hotel guests, or capture marketing details. The network holds each new device in a restricted state until the guest completes the page, which gives the business control and a record of who connected.
At home
Phones detect portals automatically. Right after joining, your device requests a known test page, such as captive.apple.com or Google's connectivitycheck address. If the network answers with something else, the phone knows it is being intercepted and opens a mini browser showing the login page. If that fails, visiting a plain http:// address, not an https:// one, can trigger it, because the network cannot quietly redirect encrypted pages.
At work
Most portals work by holding new devices in a walled garden. The access controller identifies each device by its MAC address, blocks all traffic except DNS and the portal server, and redirects web requests to the login page. After the guest authenticates, often through a RADIUS server or cloud service, the controller lets that MAC address through for a set time. Because phones now randomize MAC addresses per network, sessions can reset when a device changes its address.
At home
While portals look official, anyone can create a Wi-Fi network named 'Airport Free WiFi' with a convincing login page. Because many portals run on open networks with no Wi-Fi encryption, attackers nearby can also watch any unencrypted traffic. Real portals only need simple steps, such as accepting terms or entering a room number. In my opinion, no legitimate Wi-Fi needs your email or bank password, and a request for one means you should disconnect.
At work
Classic portals depend on hijacking web requests, which breaks with HTTPS, HSTS, and apps that never open a browser. RFC 8910 lets the network advertise the portal's address through DHCP or IPv6 router advertisements, and RFC 8908 defines an API that tells the device whether it is still captive and for how long. A sound deployment also uses HTTPS for the portal, isolates guests on their own VLAN, limits bandwidth, and keeps collected personal data minimal under PIPEDA.
Real-world examples
At home
Carlos connected to Wi-Fi at the Calgary airport. A page popped up asking him to accept the terms, and after tapping 'Connect' he could browse normally.
At work
Aisha manages IT for a boutique hotel in Niagara-on-the-Lake. She set up a captive portal asking for room number and last name, keeping guest Wi-Fi separate from the hotel's business network.
How it compares
| feature | Captive portal | Password-protected Wi-Fi |
|---|---|---|
| How guests connect | Join, then accept or log in on a web page | Enter a password when joining |
| Data collection | Can collect emails or details | None |
| Encryption | Often an open network | Encrypted with WPA2 or WPA3 |
| Guest friction | Higher | Lower |
Portals add control and terms. Passwords add encryption with less fuss.
For analysts
If your business runs a captive portal, I'd collect as little personal information as possible. Every email address gathered is data you're now responsible for protecting.
History & origin
Captive portals spread in the 2000s as hotels, airports, and coffee shops began offering Wi-Fi and needed a way to show terms of use, charge for access, or collect emails. Phones and laptops developed automatic detection, such as Apple's captive network assistant, which checks a test web address and pops up the login page when access is blocked. Because older portals worked by hijacking web requests, they broke as more sites switched to HTTPS. The IETF published standards in 2020, RFC 8908 and RFC 8910, letting networks announce captive portals properly through DHCP and an API. In my view, captive portals are a clunky necessity, and the safest habit is never to type a real password into one.