PlayInfoBox

Home /Network /How Public Wi-Fi Login Screens (Captive Portals) Work

How Public Wi-Fi Login Screens (Captive Portals) Work

See step by step why a login screen appears the moment you join public Wi-Fi.

What a captive portal is

The login, terms-agreement, or access-code screen that appears when you connect to public Wi-Fi at a café, airport, or hotel is called a captive portal. It is a system that blocks network access to any other site entirely until you get past that screen.

How it intercepts all your traffic

The moment a device joins the Wi-Fi network, the router or gateway forces every request to redirect to the portal page while the device remains unauthenticated, except for a small allow-list of addresses reachable even before login — commonly called a "walled garden."

Why the login screen pops up automatically

Right after connecting to Wi-Fi, phone and computer operating systems send their own request to a fixed detection address (like Apple's captive.apple.com or Android's generate_204) to check whether a normal response comes back. When that request gets redirected to the portal instead, the OS detects it and automatically opens a login popup window without you needing to open a browser yourself.

Why HTTPS sites sometimes trigger a certificate warning

A portal cannot, in principle, directly intercept the content of encrypted HTTPS traffic. But some older-style portals still try to force-redirect HTTPS requests to their own page anyway, and when they do, browsers detect the domain mismatch and throw a security certificate warning. Modern portals are designed to avoid this by intercepting only the OS's plain HTTP detection request.

The security risk that remains even after logging in

Getting past the login screen and authenticating successfully does not make that network safe. You are still sharing the same public Wi-Fi network with everyone else connected to it, so any unencrypted traffic you send remains exposed to potential eavesdropping.

Fixing common connection issues

If the login screen does not appear automatically, try opening a fresh browser window and visiting an unencrypted site (one that starts with http://), or turn your Wi-Fi off and back on to trigger the detection process again — either usually resolves it.

Worried about public Wi-Fi itself?

Even after successfully getting past a captive portal, the risks of the underlying public network remain. It is worth reviewing general public Wi-Fi safety practices as well.

Want to encrypt your traffic more thoroughly?

If you need to handle sensitive information, encrypting your traffic with a VPN is the most reliable safeguard. VPN basics are worth reading up on too.

Frequently Asked Questions

Why does the login screen keep coming back?

Authentication is typically tied to your device's MAC address or a session cookie and only lasts for a limited window, often a few hours. Once that window expires, or if you connect from a different device, you will need to go through the login process again.

How can I tell if a portal login screen is safe?

Wi-Fi provided directly by an official store or venue is generally safe, but fake networks with a similar-looking name (say, an SSID that is one character off from the real store name) are sometimes set up specifically to trick people. Be especially cautious of any login screen that asks for personal information or payment details.