How is Passpoint different from ordinary guest Wi-Fi?
Ordinary guest Wi-Fi often asks a person to find a network name, accept terms in a captive portal, or type a shared password. Passpoint lets the device evaluate advertised network information against an installed profile or credential. When the device and network recognize one another, authentication can happen with little or no user action.
That automation makes Passpoint useful for roaming and carrier offload. It does not mean the venue Wi-Fi replaces the mobile carrier, nor does it guarantee every subscriber will connect.
How discovery and authentication work
Common credential approaches can include SIM-based methods and certificate- or username-based enterprise authentication. The applicable EAP method, identity handling, certificate trust, and roaming relationship depend on the service provider and deployment. An access point advertising Passpoint information is only one part of the system.
RADIUS provides authentication, authorization, and accounting functions in many enterprise designs. RadSec adds TLS protection to RADIUS transport between supported components. Network architects should validate certificate lifecycle, identity privacy, logging, failure behavior, and trust boundaries instead of treating “RadSec enabled” as a complete security answer.
Is Passpoint secure?
Passpoint can support a stronger user experience than open Wi-Fi because it is built for authenticated, policy-based connectivity. Security still depends on the complete deployment. Wi-Fi encryption, EAP method, anonymous identity behavior, certificate validation, management-plane security, VLAN policy, firewall rules, DNS, backhaul, monitoring, and patching all matter.
- Use supported enterprise authentication and current encryption appropriate to the deployment.
- Protect subscriber identity where supported; avoid exposing unnecessary permanent identifiers.
- Separate offload, guest, staff, POS, building, and management traffic by policy—not just by name.
- Validate certificates, AAA reachability, fail-open/fail-closed behavior, and revocation handling.
- Monitor authentication success, DHCP/DNS behavior, latency, RF health, throughput, and abuse.
How does Passpoint relate to carrier offload?
Carrier offload needs a reliable way for eligible subscriber devices to find and trust venue Wi-Fi. Passpoint provides that access framework. The separate commercial program determines which profiles are enabled, what traffic is eligible, how it is measured, and whether the venue receives compensation.
A technically valid Passpoint SSID can exist without a paid offload program. Conversely, a commercial agreement cannot make unsupported hardware or incorrect authentication work. Technical and commercial qualification must both succeed.
What should an IT team validate before implementation?
- Exact access-point, controller, cloud, firmware, and license support
- Passpoint release/features, ANQP elements, roaming consortium configuration, and profile matching
- EAP method, certificates, RADIUS/RadSec endpoints, redundancy, and timeout behavior
- SSID, VLAN, firewall, QoS, client isolation, DHCP, DNS, and internet egress
- Management access, audit logs, data retention, incident response, and change ownership
- Staged testing across supported device types and negative tests for noneligible devices
- Capacity and performance thresholds that protect operational networks
Continue with the carrier-offload Wi-Fi requirements checklist for a practical inventory process.
Frequently asked questions
Is Passpoint the same as Hotspot 2.0?
The names are closely related: Hotspot 2.0 describes the technical program and Passpoint is the Wi-Fi Alliance certification and market name commonly used for compatible implementations.
Does Passpoint make Wi-Fi automatically secure?
No. Passpoint supports secure discovery and authentication, but security depends on credentials, encryption, identity privacy, RADIUS or RadSec design, certificate handling, segmentation, monitoring, and operational controls.
Will every device connect to a Passpoint network?
No. The device must support the required profile and credentials, and the network must advertise a compatible service. Policy, roaming arrangements, user settings, and local program enablement also matter.
Does Passpoint require a captive portal?
Passpoint is designed to avoid repeated manual network selection and captive-portal login for authorized users. A separate guest network may still use a portal.
What is RadSec?
RadSec transports RADIUS authentication over TLS. It can protect authentication traffic between network components, but it is one part of a larger architecture and is not required in exactly the same way for every deployment.