How OTP WiFi Login Works, and Why Codes Sometimes Don't Arrive

OTP (one-time password) login is the most common way Indian hotels, cafes, hospitals and co-working spaces put guests online. The guest joins the WiFi, a login page opens, they enter their mobile number, a code arrives, and they are connected. It replaces a shared password with something better: every session belongs to a verified person. This guide explains what happens at each step, why OTPs sometimes fail in India, and what to check when guests complain.

The short answer: OTP WiFi login uses a captive portal, a login page the network shows before allowing internet access. The guest enters a mobile number, the platform sends a one-time code by SMS, WhatsApp or email, and when the guest types it back, the router lets that device online for a set time. Codes that fail to arrive are usually a delivery problem, such as an unregistered SMS template, weak indoor signal or a wrong number, and offering WhatsApp or email as a second channel fixes most of them.

What happens, step by step

1. The guest joins your WiFi network. The phone has a connection to your router, but the router is not yet letting its traffic out to the internet.
2. The login page opens on its own. Phones and laptops test every new network by loading a known web address in the background. On a captive network that test is redirected, the phone notices, and it opens the login page automatically. This is why a guest usually does not need to open a browser.
3. The guest enters a mobile number. Some venues also ask for a name, or an email for a receipt, at this step.
4. The platform sends a one-time code. By SMS, by WhatsApp, or by email, depending on which channels the venue has turned on.
5. The guest types the code back. The platform checks it against what it sent.
6. The router releases the device. The platform tells the router that this device, identified by its hardware (MAC) address, may now reach the internet, under the venue’s limits for speed, number of devices and time.
7. A session record is written. Who signed in, from which device, at what time, and later, when they left and how much data they used.

What a captive portal is explains steps 1, 2 and 6 in more depth.

Why OTP instead of a shared WiFi password?

A shared password lets in everyone who has it, including people who left months ago, and tells you nothing about who is online. An OTP login gives you three things a password cannot:

• A person behind every session. Each session is tied to a verified phone number, which matters for your own records and for the questions covered in guest WiFi logs in India.
• Control over one guest without affecting the rest. You can limit or block one guest instead of changing the password for everyone.
• Fair limits per person. A speed or device limit can apply to each guest, so one heavy user cannot slow the whole venue. See per-guest speed and session limits.

Why do WiFi OTPs sometimes not arrive in India?

Almost always for one of these reasons, and each has a different fix.

The SMS template or sender is not registered on DLT

Since TRAI’s (Telecom Regulatory Authority of India) Telecom Commercial Communications Customer Preference Regulations, 2018, every business SMS in India must come from a sender header and a message template registered on the DLT (Distributed Ledger Technology) platform run by the telecom operators. OTP messages go in the transactional category. If the header or template is not registered, or the text sent does not match the registered template exactly, operators can block the message and the guest receives nothing. This is the provider’s job, not yours, but it is worth asking any vendor whether its OTP SMS route is DLT-registered.

A related point: a number on the DND (Do Not Disturb) list should still receive a properly registered transactional OTP. DND is aimed at promotional messages.

The guest is indoors with weak mobile signal

A basement restaurant, a hospital ward or a hotel room behind thick walls can have strong WiFi and almost no mobile signal. The guest needs the code to get on the WiFi, but the code needs mobile signal to arrive. WhatsApp OTP avoids this: some phones can reach WhatsApp over mobile data that is too weak for a quick SMS, and the code lands in an app that is already open. WhatsApp OTP vs SMS compares the two in detail.

The number was mistyped, or it is a foreign number

A guest who mistypes one digit waits for a code that went to someone else. Make the number easy to check on the login page. International visitors may not have a working Indian SIM, so they need an option that does not depend on SMS: email OTP, or a voucher code issued at the front desk. Vouchers and access control explains when vouchers work best.

The guest is requesting codes too fast

Login platforms limit how many codes one number can request in a short time, to stop abuse and SMS cost spikes. A guest who taps “resend” repeatedly can hit that limit. Asking them to wait a minute and try once usually works.

Why do returning guests get asked for a new OTP?

Usually because their phone looks like a new device to your network. Modern phones do not show networks their real hardware address. They use a private address for each network instead:

• iPhone and other Apple devices use a private WiFi address for each network. On iOS 18 and later, a network with no WiFi password, which many guest networks are, gets a rotating private address by default, and Apple says it changes about every two weeks (Apple Support).
• Android 10 and later uses a randomised address for each network by default (Android Open Source Project).

So a regular who visits once a month may be asked to sign in again, even though they used the same phone last time. That is expected, and it protects the guest’s privacy. What should not happen is being asked again in the same visit. When a phone reconnects after sleeping, the login page should first check whether that device still has a live session and, if it does, put the guest straight back online. Wyfy Guest’s login page does this before asking for any code.

Why does the login page sometimes not appear?

• The guest opened a secure (HTTPS) website first. A network cannot redirect a secure page without a certificate warning, so the browser shows an error instead of the login page. Opening any plain http:// address, or switching WiFi off and on to trigger the phone’s own check, brings the login page back.
• A VPN or private DNS setting is on. Some phones’ VPN apps or “private DNS” settings block the background check, so the phone never notices the login page. Turning them off until after sign-in fixes it.
• The session ended. Once a session reaches its time limit or the idle timeout, the guest needs to sign in again.

Guest WiFi login problems, explained covers more of these cases from the dashboard side.

How OTP login works in Wyfy Guest

• Sign-in methods per location. Mobile OTP by SMS, WhatsApp OTP, email OTP and voucher codes, each turned on or off per location. A hotel might run SMS and WhatsApp OTP plus vouchers for foreign guests. A cafe might lead with WhatsApp.
• Your branding on the page. Your logo, colours and welcome message, and more than one language if your guests need it.
• A live session is reused. A device that still has a live session at your venue goes straight back online without a new code.
• Per-guest limits. Speed, number of devices and idle timeout per guest, where your router supports them.
• A record of every session. Who connected, from which device, for how long and how much data they used, with phone numbers hidden from staff by default.
• It runs on the routers you already have. No new hardware just to get an OTP login.

The product side of this, with the sign-in methods side by side, is on the OTP WiFi login page.

Common questions about OTP WiFi login

How does OTP-based WiFi login work?

A guest joins the WiFi, and a login page (captive portal) opens. They enter a mobile number, receive a one-time code by SMS, WhatsApp or email, and type it in. The platform then tells the router to let that device online for a set time, and records the session.

Is OTP WiFi login mandatory in India?

No rule we know of names OTP specifically. What matters is being able to tie a session to a person and keep records, which an OTP login does and a shared password does not. See guest WiFi logs in India for what CERT-In’s directions say about logs.

Why is my guest not receiving the WiFi OTP?

The common causes are an SMS header or template not registered on DLT, weak mobile signal indoors, a mistyped or foreign number, or too many resend requests. Offering WhatsApp OTP, email OTP or a voucher alongside SMS covers most cases.

Can guests log in to WiFi without an Indian mobile number?

Yes, if the venue offers email OTP or voucher codes. Both work for international guests who do not have an Indian SIM.

Why do guests have to enter the OTP again on a later visit?

Phones use a private, per-network hardware address, and on open networks iPhones rotate it by default about every two weeks. To the network, the phone can look new. Within the same visit, a well-built login page reuses the live session instead.

Does OTP login slow down the WiFi?

No. The login page only affects the moment before a guest is online. After that, speed depends on your internet line, your access points and any per-guest limit you set.

If you want to see the full sign-in flow on a real phone, book a demo and we will set it up on your own router while you watch.