Should Guest WiFi Have a Password? Open Network vs Login Page
A WiFi password decides who can join the network. A login page decides who gets internet, and records who they were. Most venues that ask "should guest WiFi have a password" actually want the second thing.
Should guest WiFi have a password? The answer depends on which of two jobs you mean. A WiFi password decides who can join the network. A login page decides who gets internet once they have joined, and keeps a record of who it was. A venue that wants to stop strangers using its line, know who was online and have access expire on its own is asking for the second job, and a password alone does not do it.
This guide explains what each layer protects, whether an open network is safe, and which combination fits a cafe, hotel, office or co-working space.
What a WiFi password actually does
The password on a WiFi network is a WPA2 or WPA3 key, checked by the access point the moment a device tries to join. It does two things:
- Keeps out devices that do not have it. A phone without the key never gets an address on the network.
- Encrypts the radio link. Traffic between the device and the access point is scrambled, so someone with a laptop in the car park cannot read it off the air.
Both are useful on your own network, where the devices are yours and the key stays with you. On a guest network the first one stops working the day you give the key out. Once it is on the receipt, the whiteboard or the waiter’s lips, anyone who has ever been in can join from the street, and changing it means reconnecting every device of your own. The password does not know who joined, cannot limit what one guest uses, and never expires.
What a login page does
A login page, called a captive portal in networking, works after a device has joined. The network holds the device’s traffic back, opens a sign-in screen, and releases the device to the internet once the guest signs in. On that screen the guest proves who they are, with a one-time password (OTP) sent to their phone or email, or with a voucher code the venue handed out.
That gives the venue what a password cannot:
- Each guest is identified. The session is tied to a phone number or a voucher, not to “whoever had the key”.
- Access expires. A session ends after the time you set, and a voucher stops working on its own.
- Limits apply per guest. Speed, number of devices and session length are set for each person, not for the network as a whole.
- It works without a password. The network can be open, so the guest’s first step is simply tapping the name.
The login page runs on an open network or on one with a password. The two are separate layers, which is why the question “password or login page” is really “which layers do I want”.
The four combinations
| Setup | Who can join | Who gets internet | Suits |
|---|---|---|---|
| Open, no login page | Anyone in range | Anyone in range | Almost nobody; a line with no limits and no record |
| Password only | Anyone with the key | Anyone with the key | A home, or an office with few visitors and a key that is kept private |
| Open with a login page | Anyone in range | Guests who sign in | Cafes, hotels, clinics, co-working: most venues |
| Password with a login page | Anyone with the key | Guests who sign in | Venues that want the radio link encrypted as well, and accept one more step per guest |
The third row is what most guest WiFi software sets up, and it is the setup guests already know from airports and hotel chains. The fourth row is the belt-and-braces version. The first row is what a venue is running when it turns on a router’s open guest network and forgets about it.
Is an open network safe?
The worry about open WiFi comes from a time when a lot of web traffic was sent in plain text. That has changed. Nearly every website, app, payment page and messaging service now uses HTTPS, which encrypts the traffic between the guest’s phone and the service it is talking to, on any network, open or not. Someone listening to an open network today sees which sites a device connects to, not what it sends.
What is left is the risk between devices on the same network, and that is not something a shared password fixes, because every guest has the key. It is fixed by two settings on the network:
- Client isolation, so one guest’s device cannot see another’s. Most business access points offer it.
- Separation from your own network, so a guest cannot reach your billing machine, printer or CCTV. Guest network isolation explains how to set it up and test it.
Newer phones and access points also support Wi-Fi Enhanced Open, a standard that encrypts the radio link on a network with no password. Where your access points support it, it gives an open network the encryption of row four without the extra step. Ask your installer whether yours do.
What Indian rules expect
Rules on public internet access in India have long expected the venue that offers it to be able to say who was using a connection at a given time. A password on the wall identifies nobody; everyone online at 8pm is the same anonymous person. A login page that ties a session to a phone number does the identification, and a session record keeps it. Is your guest WiFi login legal in India goes through what the expectation is, and guest WiFi logs in India covers how long the record is kept.
Which to choose, by venue
- Cafe or restaurant. Open network, OTP login. Guests are there for one sitting and will not type a password from the menu card and then sign in as well.
- Hotel. Open network, OTP login, plus vouchers at the front desk for guests whose phone has no Indian number. Sessions long enough to cover a stay.
- Office with visitors. Either a password kept by reception with a voucher login on top, or an open network with vouchers only, so nobody gets on without the front desk handing out a code.
- Co-working space. Open network, OTP for day visitors, vouchers that last a month for members. Members’ own devices can be exempted from the login.
- Clinic or bank branch. Open network, OTP login, short sessions, and strict separation from the systems that run the business.
In every row the login page is doing the work. The password is an optional extra for venues that want the radio link encrypted and can live with the extra step. Vouchers as access control covers the voucher side in more depth.
Where Wyfy Guest fits
Wyfy Guest is guest WiFi software for venues in India. It adds the login page: guests sign in with an OTP by SMS, WhatsApp or email, or with a voucher code, on a page with your name on it, and each session runs under the speed, device and time limits you set per location. The login works on the network your installer has set up, open or with a password; that choice stays with you. Whether the login screen sits on a bare open network or behind a key, it is the screen that knows who was online, and that is the part a password was never going to do. The demo is free if you want to see the sign-in flow on your own phone.