A captive portal is the web page a network shows before it lets you online, usually asking for a room number, email address or terms agreement. Signing in is generally fine if you enter only what the venue needs. Never type work passwords or payment details into a portal you did not expect.
Definition
A captive portal restricts what a device can do until the user meets some condition. The IETF describes this in RFC 8910 as a mode that highly restricts what the user can do until they have satisfied the portal conditions. The RFC defines a way for a network to tell a device, through DHCP or router advertisements, where the portal is, so the operating system can open it properly.
In plain terms: you join the Wi-Fi, your device notices there is no real internet yet, and it opens a small browser window with the venue's page.
What the portal does and does not prove
A portal is a gate set by whoever runs the network. It is not a security feature for you. It tells you nothing about whether the network is genuine, and it adds no encryption. A fake network can show a portal that looks identical to the real one. For that reason, see What is an evil twin Wi-Fi network.
What is reasonable to enter
| Request | Reasonable? |
|---|---|
| Room number and surname | Yes, this is the normal pattern |
| A code printed on your receipt or key card | Yes |
| Email address | Yes, ideally a throwaway or personal one |
| Tick box for terms | Yes, after skimming |
| Work email and password | No |
| Social login with a work account | No |
| Card number for free Wi-Fi | No |
| Install a certificate or profile | No |
The last row matters most. Installing a certificate or configuration profile from a Wi-Fi page can let the network operator inspect or redirect your traffic. There is rarely a good reason for a guest network to ask.
Practical steps
- Join the network that the venue's staff or printed card names.
- Wait for the portal window, or open a plain HTTP page to trigger it. A site that does not use HTTPS, such as a captive detection address, is how many portals are triggered.
- Complete the form with the minimum information.
- Check that later sites load over HTTPS with valid certificates.
- Disconnect and forget the network when you leave.
If the portal never appears, do not hunt for a way to force it with a third party tool. Ask the venue.
Why work accounts do not belong here
A portal page controls what you see. If it asks for a work account, a mistaken entry gives the page owner your password, and MFA codes can be relayed in real time. Use a phone hotspot when you need to sign in to anything that matters. See Phone hotspot or hotel Wi-Fi for work.
Safeguard does not replace your network controls. It scans dependencies and SBOMs and enforces policy gates on code. Try a free scan to see what your repositories pull in.
Quick check
Is it safe to use a made up email at a portal?
Usually yes, unless the venue sends a code to that address to unlock access. Use an address you can open but that is not tied to work.
Why does the portal use plain HTTP sometimes?
Devices probe a plain page to detect a portal, because a secure page would show a certificate error when the network intercepts it. RFC 8910 offers a cleaner discovery method.
Sources
Last reviewed: 19 October 2026.
