A captive portal is a web page that a Wi-Fi network displays before granting access to the internet. If you have ever connected to Wi-Fi at a hotel, airport, café or train and been asked to agree to terms, input your room number, provide an email address or view a brief advertisement before content loaded, you have used one.
The name describes its function: until you finish the page, your device is “captive”. It connects to the network, but the system only allows traffic to reach the portal.
How a captive portal works
In reality, this system involves coordination among three elements: your device, the Wi-Fi access point or gateway, and the web server hosting the login page.
- You connect to the network. Typically, captive portal setups allow open access without a password or rely on a shared key. Your device receives an IP address normally.
- The system keeps you contained. The gateway restricts outgoing traffic towards the internet, permitting only specific exceptions like the portal server.
- Your device notices it is captive. Upon connection, phones, laptops, and browser software silently query a specific test address. If the response differs from expectations, they conclude a portal exists. (Details follow later.)
- The web form appears. The device displays the portal within an internal browser. Older configurations might catch your initial HTTP request and redirect it to the portal rather than allowing access elsewhere.
- You finish the form. You check a box, input a voucher or room number, authenticate via email or social media, or make payment.
- Access is restored. The portal informs the gateway to permit your device, often recognized by its MAC address, for a defined period. Subsequently, your data moves freely until the session ends.
Modern networks might declare the portal directly without needing interception. RFC 8910 enables the network to distribute the portal’s URL via DHCP or IPv6 router ads, while the Captive Portal API (RFC 8908) allows a device to query its captive status and duration. While support expands, many existing portals continue using traditional redirection methods.
How your phone or laptop detects a captive portal
Each primary operating system performs a connectivity test immediately upon joining a network. It retrieves a small, recognized page using standard HTTP and contrasts the result against anticipated data:
| Platform | What it checks | Expected answer |
|---|---|---|
| iPhone, iPad, Mac | captive.apple.com/hotspot-detect.html | A response indicating success |
| Android, ChromeOS | connectivitycheck.gstatic.com/generate_204 | A blank 204 No Content reply |
| Windows | www.msftconnecttest.com/connecttest.txt | The phrase “Microsoft Connect Test” |
| Firefox | detectportal.firefox.com/canonical.html | A recognized success page |
When a captive portal intercepts this request, your device receives the portal’s page rather than the anticipated data. This is when you encounter phrases like “Sign in to network”, “Captive portal login”, or a pop-up authentication window. Security software and VPN clients also display a “captive portal detected” notification because they recognize this event and wait for you to authenticate. Further details on that message are available in Understanding the “Captive Portal Detected” Error.
What captive portals are used for
For the administrators managing the network, this portal serves as the primary display for each visitor. Typical applications include:
- Policies and conditions. Establishments such as hotels, hospitals, libraries, and public spaces use the portal to ensure visitors agree to conditions prior to accessing the internet.
- Restriction methods. Items like vouchers, room codes, passcodes, or subscription services restrict access to the network and determine duration of usage.
- Promotion and visitor info. Shops, restaurants, and locations request an email address or social login for complimentary Wi-Fi, creating a database of actual attendees. Consult Gathering Customer Email Addresses Through Shared Wi-Fi.
- Identity and advertisement. Both the portal and the screen displayed upon successful authentication serve as excellent locations for promotions, menus, event listings, or loyalty program registration.
- Statistics. Metrics such as visitor numbers, time spent, and frequency of return trips are derived from identical sessions.
Captive portal login vs. Wi-Fi password
An Wi-Fi passcode (using WPA2 or WPA3) scrambles the wireless signal to exclude those without knowledge of the code. A captive portal determines who gets internet access and on what terms once a user connects. Numerous systems employ both: a printed password to encrypt data, alongside a portal for gathering consent or information.
A warning for visitors: if a network is open and relies solely on a captive portal, data transmitted through the air remains unencrypted. Consult Is a Captive Portal Login Safe? to understand the practical implications.
Common captive portal problems
- The login page does not appear. Check How to Force a Captive Portal Login Page to Open.
- “Captive portal login” keeps popping up on Android or iPhone. Consult Captive Portal Login on Android and iPhone.
- VPN or security software reports “captive portal detected”. Read the “Captive Portal Detected” guide.
- You run UniFi equipment and want your own portal. Visit UniFi Captive Portals Explained.
Frequently asked questions
Is a captive portal the same as a hotspot?
That is incorrect. The term “Hotspot” typically refers to the public Wi-Fi connection itself, while the captive portal serves as the entry screen managing permissions. The majority of business-grade hotspots rely on a captive portal.
Why does a captive portal ask for my email?
Complimentary Wi-Fi is frequently funded via advertising. Companies acquire a method to reach attendees, while users receive internet access. The conditions regarding how your information is used are typically located within the agreement found on the portal screen.
Can a captive portal see what I browse?
The network operator observes which websites you visit, though they cannot view data within HTTPS connections. Employing HTTPS consistently, or using a VPN post-authentication, ensures your activity remains hidden from the network.
Do captive portals work with HTTPS sites?
This does not apply to the first redirection step. A network cannot quietly change an encrypted HTTPS request without triggering a certificate alert, explaining why devices rely on unencrypted HTTP checks to find the portal.