A captive portal is a web page that a Wi-Fi network shows you before it lets you onto the internet. If you have ever joined the Wi-Fi in a hotel, airport, café or train and been asked to accept terms, enter a room number, type in an email address or watch a short ad before anything loaded, you have used one.
The name says what it does: until you complete the page, your device is “captive”. It is connected to the network, but the network only lets it reach the portal.
How a captive portal works
Behind the scenes, a captive portal is a small piece of choreography between your device, the Wi-Fi access point or gateway, and a web server that hosts the login page.
- You join the network. Most captive portal networks are open (no Wi-Fi password) or use a shared password. Your device gets an IP address as usual.
- The network holds you in a “walled garden”. The gateway blocks your traffic to the internet, with a short allow-list of exceptions such as the portal server itself.
- Your device notices it is captive. Phones, laptops and browsers quietly request a known test address as soon as they connect. If the answer is not what they expect, they assume there is a portal in the way. (More on this below.)
- The login page opens. Your device shows the portal in a small, built-in browser window. On older setups the gateway intercepts the first plain-HTTP page you load and redirects it to the portal instead.
- You complete the page. You tick a box, enter a voucher or room number, sign in with an email or social account, or pay.
- The gateway lets you out. The portal tells the gateway to authorise your device, usually identified by its MAC address, for a set time. From then on your traffic flows normally until the session expires.
Newer networks can also announce the portal directly instead of relying on interception. RFC 8910 lets the network hand out the portal’s address in DHCP or IPv6 router advertisements, and the Captive Portal API (RFC 8908) lets a device ask whether it is still captive and for how long. Support is growing, but most portals in the wild still use the classic redirect approach.
How your phone or laptop detects a captive portal
Every major platform runs a “connectivity check” right after joining a network. It fetches a tiny, well-known page over plain HTTP and compares the response with what it expects:
| Platform | What it checks | Expected answer |
|---|---|---|
| iPhone, iPad, Mac | captive.apple.com/hotspot-detect.html | A page that says “Success” |
| Android, ChromeOS | connectivitycheck.gstatic.com/generate_204 | An empty 204 No Content response |
| Windows | www.msftconnecttest.com/connecttest.txt | The text “Microsoft Connect Test” |
| Firefox | detectportal.firefox.com/canonical.html | A known success page |
If a captive portal intercepts that request, the device gets the portal’s page instead of the expected answer. That is the moment you see “Sign in to network”, “Captive portal login” or a pop-up login sheet. It is also why you sometimes see a “captive portal detected” message from security tools and VPN clients: they spotted the same thing and paused until you log in. We explain that message in detail in Understanding the “Captive Portal Detected” Error.
What captive portals are used for
For the people running the network, the portal is the one screen every guest sees. Common uses:
- Terms and acceptable use. Hotels, hospitals, libraries and public venues use the portal to make guests accept terms before going online.
- Access control. Vouchers, room numbers, passwords or paid plans limit who can use the network and for how long.
- Marketing and guest data. Retailers, cafés and venues ask for an email address or a social login in exchange for free Wi-Fi, building a contact list of real visitors. See Gathering Customer Email Addresses Through Shared Wi-Fi.
- Branding and promotion. The portal and the page shown after login are prime space for offers, menus, events or a loyalty sign-up.
- Analytics. Visit counts, dwell time and repeat visits come from the same sessions.
Captive portal login vs. Wi-Fi password
A Wi-Fi password (WPA2 or WPA3) encrypts the radio link and keeps out anyone who does not know it. A captive portal decides who gets internet access and on what terms after they have joined. Many networks use both: a password printed on the wall to encrypt traffic, plus a portal to collect consent or details.
One caution for guests: an open network with only a captive portal does not encrypt traffic over the air. Read Is a Captive Portal Login Safe? for what that means in practice.
Common captive portal problems
- The login page does not appear. See How to Force a Captive Portal Login Page to Open.
- “Captive portal login” keeps popping up on Android or iPhone. See Captive Portal Login on Android and iPhone.
- VPN or security software reports “captive portal detected”. See the “Captive Portal Detected” guide.
- You run UniFi equipment and want your own portal. See UniFi Captive Portals Explained.
Frequently asked questions
Is a captive portal the same as a hotspot?
Not quite. “Hotspot” usually means the public Wi-Fi network itself; the captive portal is the login page that controls access to it. Most commercial hotspots use a captive portal.
Why does a captive portal ask for my email?
Free Wi-Fi is often paid for with marketing. The business gets a way to contact visitors; you get internet access. You can usually find what they will do with your address in the terms on the portal page.
Can a captive portal see what I browse?
The network operator can see which sites you connect to, but not the contents of HTTPS pages. Using HTTPS everywhere, or a VPN after you have logged in, keeps your browsing private from the network.
Do captive portals work with HTTPS sites?
Not for the initial redirect. A network cannot silently redirect an encrypted HTTPS request without causing a certificate warning, which is why devices use plain-HTTP connectivity checks to discover the portal.