A captive portal is the login or terms-of-service page that appears the moment you join hotel, airport, cafe, or office guest wifi, blocking normal internet access until you accept, pay, or enter a code. It is one of the most common networking experiences there is, and also one of the most misunderstood — logging in feels like a security step, but it is really just an access gate, and it tells you almost nothing about whether the network itself is safe to use.
What changed in 2026
- Passwordless portal logins spread further. More networks now authenticate through a tapped email link or SMS code instead of a shared password typed on a splash page.
- DNS-over-HTTPS made portal detection less reliable. Devices using encrypted DNS by default sometimes fail to see the redirect at all, which is now one of the most common "wifi connects but nothing loads" complaints.
- Guidance shifted toward treating portal networks as untrusted by default, with VPN-by-default setups becoming standard advice for travel rather than a power-user habit — see how a travel router fits into that.
- Portal detection loops got better tooling on both major mobile platforms, reducing (though not eliminating) the "stuck in a loop" failure mode.
How a captive portal actually works
When a device joins a network, it sends a small background request to a known test address to check whether it has real internet access. If a router configured with a captive portal intercepts that request and returns something other than the expected response, the operating system concludes it is behind a portal and opens a login browser automatically. Until you complete that flow, the router allows DNS and access to a small "walled garden" of portal-related addresses and blocks everything else — every other request you make is silently redirected back to the login page.
Why logging in does not mean you are safe
The portal's job is authorization, not encryption. Once you are past it, your traffic travels over whatever the underlying network actually is — which on most guest wifi is a shared, unencrypted radio link where anyone else on the same network can potentially see unencrypted traffic. HTTPS on individual sites still protects that traffic in transit, but DNS lookups, connection metadata, and any non-HTTPS traffic remain exposed. A padlock in your browser after login means that one connection is encrypted; it says nothing about the network you are sitting on.
Fixing common captive portal problems
| Symptom |
Likely cause |
Fix |
| Portal page never appears |
Encrypted DNS bypassing the detection probe |
Temporarily disable DNS-over-HTTPS/private DNS |
| Connects but no internet after login |
Session tied to one device only |
Reconnect the specific device that logged in, not just the network |
| Stuck in a redirect loop |
Cached DNS or a VPN already running |
Disable VPN, flush DNS, rejoin the network |
| Portal loads but will not submit |
JavaScript or cookies blocked |
Temporarily allow cookies/scripts for that one page |
FAQ
Why does my phone show internet connected before I log in?
It usually means the connection succeeded at the network layer but the portal has not been completed yet — some devices label this ambiguously before the redirect finishes.
Can I skip a captive portal entirely?
Not through the network you are trying to use; the portal enforces access at the router level. A cellular connection or a separate device already authenticated on that network are the only ways around it.
Is it safe to enter my email or phone number on a captive portal?
Generally low risk for a legitimate venue's guest wifi, but treat it the same as any form on an unfamiliar page — verify the network name with staff if anything looks off before entering personal details.
Why does my VPN break the captive portal login?
A VPN routes all traffic through an encrypted tunnel before the portal has granted access, which means the portal never sees your login attempt. Disable the VPN, complete the portal login, then reconnect the VPN.
Where to go next