Passpoint, also known as Hotspot 2.0, is a WiFi Alliance certification that automates network discovery, authentication, and connection. Unlike regular WiFi, where you pick an SSID and re-enter a password at every venue, a device with a Passpoint profile recognizes supported networks and joins them automatically over an encrypted, WPA3-Enterprise connection—much like a phone roaming between cellular towers.
Blog
Passpoint: what it is and how it works
SUMMARY.
Passpoint, also called Hotspot 2.0, is a WiFi Alliance standard that lets devices discover, authenticate, and connect to enrolled WiFi networks automatically—no portal and no password re-entry. Built on IEEE 802.11u with WPA3-Enterprise encryption, it gives enterprises cellular-like roaming and stronger security across every location once a device installs a Passpoint profile.
IN THIS ARTICLE
In an era where connectivity is synonymous with productivity and convenience, the demand for seamless and secure WiFi access is more pressing than ever. Whether for guests in a hotel, customers in a café, shoppers in a retail store, or employees in an office, providing an effortless and secure WiFi connection can significantly enhance user experience and satisfaction. Enter Passpoint, a solution that promises to revolutionize the way users connect to wireless networks.
What is Passpoint (Hotspot 2.0) and how did it evolve?
Passpoint, also known as Hotspot 2.0, is a technology developed under the WiFi Alliance’s certification program. It builds on the IEEE 802.11u standard to streamline network access and eliminate the cumbersome process of searching for and authenticating WiFi networks each time users visit a new location.
This technology enables devices to automatically recognize and connect to WiFi networks that support Passpoint, using a previously established profile stored on the device.
Initially, the Release 1 in 2012 allowed credential provisioning via web download of a profile file. By 2014, the Release 2 introduced an improved signup process for secure WiFi access, including terms acceptance and validation steps. The 2019 update, Passpoint R3, further streamlined signup, introduced WPA3-Enterprise for enhanced security, enabled location-specific information sharing via CAPPORT API, and offered diverse billing options, including time-based, on-demand, and unlimited plans.
How does Passpoint Secure WiFi work?
Passpoint Secure WiFi revolutionizes WiFi connectivity by ensuring devices automatically connect to networks after initial profile setup, enhancing user experience and security. There are several onboarding methods:
- Enterprise mobile app
For users with enterprise’s mobile app, accepting the enterprise’s secure WiFi within the app, which is powered by a robust WiFi mobile SDK, triggers a prompt, like a push notification or banner, inviting them to add the enterprise’s WiFi to their preferred networks. The Passpoint profile is seamlessly installed during this process. This method ensures a smooth, uninterrupted in-app experience on-site, even in areas with weak cellular reception. - Captive portal
Through a captive portal, users access a network via a specific portal for easy Passpoint Secure WiFi enrollment by downloading the necessary profile. This method ensures a straightforward, hassle-free setup, eliminating any obstacles to connecting. Captive portals allow enterprises to offer a smooth, intuitive connection process to Passpoint networks, streamlining the entire user onboarding experience. - Web link
Users can conveniently download the Passpoint profile by accessing a link distributed through various methods, such as email, text messages, or QR codes. Simple on-screen instructions guide the process, which may include sharing personal details or accepting terms. This method facilitates the remote provisioning of WiFi services, ensuring connectivity is established even before the user physically arrives at the location.
Passpoint vs OpenRoaming vs captive portal: what’s the difference?
Passpoint, OpenRoaming, and captive portals solve overlapping problems in different ways. Passpoint makes the connection automatic and encrypted; OpenRoaming is a global federation built on Passpoint; a captive portal is the web login most guests already know. The table below compares them at a glance.
Dimension | Passpoint | OpenRoaming | Captive portal |
| What it is | Auto-connect WiFi standard (Hotspot 2.0, 802.11u) | Global roaming federation built on Passpoint (WBA) | Web page shown before network access |
| Connection experience | Automatic after one-time profile install | Automatic across federated networks | Manual web login on each visit |
| Authentication | Stored credential or certificate (EAP) | Federated identity via RADIUS / RadSec | Form, SMS/email, social, or click-through |
| Over-the-air security | WPA2/WPA3-Enterprise, encrypted | WPA2/WPA3-Enterprise, encrypted | Often an open network with web auth |
| Cross-venue roaming | Within enrolled networks | Yes — across unaffiliated networks | No |
| Guest data / marketing | Limited | Limited | Strong (forms, opt-in, analytics) |
| Best for | Seamless, secure reconnection | Roaming at internet scale | First-touch onboarding + data capture |
The three are complementary. A common pattern is to capture first-time guests with a captive portal, then provision a Passpoint profile so they reconnect automatically and securely on every later visit—optionally extending that reach through OpenRoaming.
What are the benefits of Passpoint WiFi for enterprises and users?
The adoption of Passpoint WiFi technology offers numerous benefits for both enterprises and their customers. For enterprises, it means providing a superior WiFi experience that can significantly contribute to customer satisfaction and retention. For users, it translates to hassle-free connectivity and enhanced security, making their online activities more seamless and protected.
Moreover, with the widespread compatibility of mobile devices and WiFi infrastructure with Passpoint Secure WiFi, its implementation has become more accessible and beneficial across different sectors, from hospitality to retail, and beyond.
Cloud4Wi delivers Passpoint as part of one platform that also runs OpenRoaming, PPSK (Private Pre-Shared Key), and WiFi Network Access Control (NAC), with the Hedy AI engine turning every secure session into visitor insight. Our Passpoint solution onboards devices through apps, captive portals, or web links, and already powers secure connectivity for more than 300 million users across 70,000+ locations in 150 countries.
Why is Passpoint the future of WiFi connectivity?
Passpoint represents a significant leap forward in wireless networking, addressing the dual challenges of convenience and security in public WiFi access. As we continue to navigate a world where digital connectivity is critical, technologies like Passpoint play a pivotal role in ensuring that our online experiences are not only seamless, but also secure. It’s clear that the future of WiFi connectivity lies in intelligent, user-centric solutions like Passpoint, promising a world where staying connected is as effortless as it is safe.
Position your organization as an innovator by embracing Passpoint and delivering automatic, secure WiFi connectivity to your users. Discover how Cloud4Wi’s Passpoint solution can transform your company. Request a demo now.
Frequently asked questions
Once a Passpoint profile is installed, the device uses the IEEE 802.11u standard to query nearby access points for the networks and roaming partners they support. When it finds a match, it authenticates with the stored credentials or certificate and connects—no portal, no manual SSID selection. The session is encrypted end to end, so onboarding happens silently in the background.
Yes. Passpoint requires enterprise-grade authentication and encrypts traffic over the air, removing the risks of open guest WiFi. Release 3 added WPA3-Enterprise support for stronger key management and protection against eavesdropping. Because each device authenticates with its own credential or certificate, operators can identify, segment, and revoke access per user without sharing one password across the venue.
Passpoint is the underlying technology that lets devices connect automatically; OpenRoaming is a WBA federation built on top of Passpoint. Passpoint handles the secure, automatic connection, while OpenRoaming adds a global trust framework so a credential from one identity provider works across thousands of unaffiliated networks. In short, OpenRoaming uses Passpoint to enable cross-venue roaming at internet scale.
Most modern devices do. Passpoint is built into recent versions of iOS, iPadOS, Android, Windows, and macOS, so no extra app is strictly required to use a profile. Support has shipped on mainstream smartphones for years, which is why enterprises can roll out Passpoint Secure WiFi across a mixed device fleet without asking users to install special software.
There are three common methods. An enterprise mobile app can install the profile after the user opts in; a captive portal can deliver it during a one-time web enrollment; or a web link sent by email, SMS, or QR code can provision it remotely. After this single setup, the device reconnects automatically on every future visit without further action.
A captive portal authenticates each visit through a web login page, which is ideal for guest data capture but requires user action every time. Passpoint connects automatically after a one-time profile install and keeps traffic encrypted. They are complementary: many enterprises use a captive portal for first-time onboarding, then hand the device a Passpoint profile for seamless, secure reconnection afterward.
© 2026 CLOUD4WI. ALL RIGHTS RESERVED.